FTC requires Nomad operators to compensate users for $186 million in losses from the crypto bridge hack
The U.S. Federal Trade Commission (FTC) announced on Tuesday that it has proposed a settlement to Nomad crypto bridge operator Illusory Systems, related to a hacking incident that nearly resulted in the theft of all platform funds.According to the FTC's complaint, Illusory Systems introduced a critical vulnerability in a code update in June 2022, which hackers began exploiting on August 1, leading to the theft of approximately $186 million in Ethereum, USDC, DAI, and WBTC assets, with user losses exceeding $100 million. The FTC alleges that Nomad, while claiming to be a "security-first" platform, failed to adequately test its code, maintain clear vulnerability reporting and incident response processes, and did not deploy basic security measures to limit user losses.Under the proposed settlement, Illusory Systems will be prohibited from making false claims about its security practices, must implement a formal information security program, undergo independent security assessments every two years, and return unreimbursed recovered funds to affected users. After the hack, Nomad only recovered $22 million of the stolen funds.