In brief

• Israel has extradited Alexander Block, formerly Alexander Gurevich, to the U.S. to face charges over the alleged theft of about $2.8 million from crypto bridge Nomad in 2022.
• Prosecutors allege that his exploit exposed a flaw that other users then used to drain more than $186 million from a Nomad-controlled wallet.
• Israel's Supreme Court rejected his appeal, ruling that exploiting a programming flaw can be unlawful computer intrusion even where the software permitted it.

Israel has extradited an Israeli-Russian citizen to the United States to face charges over the alleged theft of about $2.8 million from crypto bridge Nomad, Israel's State Attorney's Office announced on Thursday, according to a report in The Jerusalem Post.

Alexander Block, formerly known as Alexander Gurevich, was transferred to U.S. authorities early Thursday after unsuccessful appeals in Israel. He was arrested at Ben Gurion Airport in May 2025 while preparing to fly to Russia, shortly after changing his surname and obtaining a passport in his new name.

A federal grand jury in the Northern District of California indicted Block in August 2023 on four counts of computer fraud, one count of transporting stolen property and three counts of money laundering, according to Israel's Supreme Court judgment in the case. The U.S. requested his extradition in December 2024.

According to the U.S. extradition request, as set out in the judgment, a June 2022 software update left a flaw in Nomad's smart contracts that let users receive tokens on one blockchain without locking up the equivalent assets on another. Block, operating under the username "Bitlik," allegedly made six test transfers before carrying out four main transfers around August 1, 2022, receiving tokens worth more than $2.8 million. He then allegedly moved the tokens through several wallets and converted them into other cryptocurrencies to conceal their origin.

His actions exposed the flaw to other Nomad users, who drained a Nomad-controlled wallet holding more than $186 million in user funds, the request alleges. A few days later, Block returned some of the tokens and contacted a senior Nomad official on Telegram, offering to return the rest in exchange for payment for finding the flaw. He later cut off contact, and Nomad went to U.S. law enforcement.

The Supreme Court ruling

The Jerusalem District Court approved Block's extradition in July 2025. On appeal, he argued that the transactions used functions available within Nomad's automated system, and that the public record of blockchain transfers undermined the money laundering allegations.

The Supreme Court rejected both arguments, holding that exploiting a programming flaw could constitute unlawful computer intrusion even where the software technically permitted the action, The Jerusalem Post reported. It also found that publicly visible transactions do not necessarily identify the people behind wallets or rule out efforts to conceal where funds came from.

Supreme Court President Isaac Amit later rejected Block's request for a further hearing, according to the State Attorney's Office.

The August 2022 exploit drained Nomad of nearly all its funds. Because it took little technical knowledge to copy the original attack, Paradigm researcher Sam Sun likened what followed to "a frenzied free-for-all," Decrypt reported at the time.

In December 2025, the Federal Trade Commission proposed a settlement with Illusory Systems, Nomad's operator, saying the bridge lost $186 million after hackers exploited a poorly tested software update. The settlement would require the company to return recovered funds to users who have not been reimbursed. Nomad recovered about $22 million in the days after the hack.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.