The Federal Trade Commission's data breach action against crypto platform Nomad centers on a 2022 hack that drained $186 million from users, followed by a 2025 enforcement order requiring the company to return money and fix its security. The FTC announced a proposed settlement on December 16, 2025, against Illusory Systems Inc., the company doing business as Nomad, over how it handled consumer funds before and after the breach. This explainer walks through what happened, who was affected, what the FTC found, and what the proposed order actually requires — using the FTC's own announcement and independent reporting on the case.
Official resources:
- Read the official notice from FTC — Use this primary source to verify the official announcement.
- Read the official notice from Therecord — Use this primary source to verify the official announcement.
Table of Contents
- What Happened and When
- Who Was Affected and How Much Was Lost
- What the FTC Says Nomad Did Wrong
- What the Proposed Order Requires
- Why This Matters Beyond Crypto
- Frequently Asked Questions
What Happened and When
Nomad operated a "token bridge," a system that lets cryptocurrency move between different blockchain networks. On June 21, 2022, the company deployed a smart-contract upgrade that was not adequately tested, and the upgrade contained a critical error: it marked a placeholder address known as the "zero address" as a "trusted root," according to Immunefi's technical analysis of the hack. That mistake meant the system treated every withdrawal request as already verified, whether it actually was or not.
The flaw sat live for roughly six weeks before anyone exploited it. On August 1, 2022, attackers began draining funds, and because the exploit only required copying the original attacker's transaction and swapping in a new wallet address, the bridge's balance fell from about $190.7 million to under $2,000 within hours, according to reporting by The Block. The ease of copying the attack drew more than 300 separate wallet addresses into what blockchain-security firm PeckShield described to The Block as a "feeding frenzy.".
Who Was Affected and How Much Was Lost
The people affected are Nomad's own users — anyone who had crypto assets moving through or held on the bridge when the exploit occurred. Unlike a typical data breach involving stolen personal records, this incident involved the direct theft of funds from a platform users trusted to move their assets securely.
Some money did come back. A portion of the drained funds, including about $8.2 million returned by self-identified "white hat" hackers who said they took funds only to protect them from further theft, flowed back to the platform, according to the FTC's press release and PeckShield's tracking cited by The Block. Even with those returns, the FTC states that net uncompensated consumer losses still exceeded $100 million.
What the FTC Says Nomad Did Wrong
The FTC's complaint doesn't fault Nomad simply for being hacked — it faults the company for how it marketed itself and for security practices the agency says fell short of what it promised. According to the FTC's press release, summarized in an analysis by Hunton Andrews Kurth, Nomad marketed itself as "security-first" while failing to follow secure coding practices and lacking any vulnerability-disclosure process for outsiders to report problems.
The complaint also alleges Nomad skipped widely available tools that could have limited the losses once the exploit began, despite having already been warned about inadequate testing and insufficient security staffing. That combination — the marketing claim paired with the alleged gaps — is what put the case within the FTC's existing authority over deceptive and unfair practices, the same framework it has used in traditional data-breach cases.
What the Proposed Order Requires
The FTC voted 2-0 on December 16, 2025, to accept a proposed order against Illusory Systems for public comment, according to reporting by The Record. The order would require the company to distribute roughly $37.5 million in recovered funds to users who remain uncompensated.
Beyond the payout, the order would bar Illusory Systems from misrepresenting its security practices going forward and would require it to implement a comprehensive information-security program, with independent assessments every two years. As of the announcement, none of this was final — the order faced a 30-day public-comment period after publication in the Federal Register before the Commission would decide whether to make it binding, per the FTC's press release.
Why This Matters Beyond Crypto
The FTC was explicit that it is treating this as a data-security enforcement matter, not a crypto-specific one. According to the National Law Review's analysis, the agency is signaling it will hold platforms handling consumer funds or data to the same "reasonable security practices" standard it has applied in breach cases against companies like Equifax and Blackbaud.
For readers tracking enforcement trends, that framing matters: it means a company doesn't need to be a traditional bank or retailer to fall under the FTC's data-security authority. Any platform that promises security to consumers — and then falls short of its own claims — can face the same kind of order, regardless of the underlying technology.
- Nomad users still uncompensated should watch for FTC or company communications about the $37.5 million distribution once the order is finalized.
- Anyone evaluating a crypto platform's security claims can treat "security-first" marketing as a claim the FTC will scrutinize, not a guarantee.
- Companies handling consumer funds or data, in any sector, should expect the same reasonable-security standard applied here.
Frequently Asked Questions
Is the FTC order against Nomad final?
No. As of the December 16, 2025 announcement, it was a proposed order open to a 30-day public comment period before the Commission could finalize it.
How much money is Nomad required to return under the proposed order?
The proposed order requires Illusory Systems, operating as Nomad, to distribute approximately $37.5 million in recovered funds to users who remain uncompensated.
How did the 2022 Nomad hack happen?
A faulty smart-contract upgrade deployed on June 21, 2022 mistakenly treated an unverified placeholder address as trusted, letting attackers submit withdrawal requests that the system accepted without real verification.
You Might Also Like
- Cybersecurity — 8-K Cyber Incident Explained: Timeline, Exposure, and Response
- What Is the FBI PeopleSoft Data Breach Contractor Investigation About?
- How to Tell if a Government Data Breach Notice Is Legitimate