Israeli national extradited to the US over alleged $2.89 million Nomad Bridge exploit
The US Justice Department says Alexander Gurevich, 49, has been extradited from Israel to face charges that he exploited a smart contract on the Nomad Bridge in 2022 and laundered the virtual currency he took.
On 30 October 2026 the US Department of Justice (DOJ) announced that Alexander Gurevich, a 49-year-old Israeli national, had made his first appearance in federal court in the Northern District of California. He was arrested in Israel in May 2025 and was recently extradited to the United States. He faces a 2023 indictment.
According to the indictment, Gurevich exploited a smart contract on the Nomad Bridge to steal about $2.89 million in virtual currency. A bridge is a service that moves crypto assets between blockchains, and a smart contract is code on a blockchain that runs automatically. The DOJ says that on or about 1 August 2022 he carried out four exploit transactions that moved 103 WBTC (wrapped bitcoin) and 300 WETH (wrapped ether) to an address he controlled.
Prosecutors allege that Gurevich then converted the funds, including into bitcoin, and moved them through several addresses to hide where they came from and who owned them. He is charged with causing damage to a protected computer, interstate transportation of stolen money, and money laundering. The DOJ says the money laundering charge carries a maximum of 20 years in prison, and the other two charges a maximum of 10 years each. An indictment is only an allegation, and Gurevich is presumed innocent unless proven guilty in court.
The FBI is investigating the case. The DOJ said its Office of International Affairs and Israeli authorities gave substantial help. Trial attorneys from the DOJ's Computer Crime and Intellectual Property Section and the US Attorney's Office for the Northern District of California are prosecuting.
Why it matters to AML professionals
Crypto thefts from bridges and smart contracts are often followed by fast conversions and hops between addresses to break the link to the stolen funds. Cases can be charged years after the theft and pursued across borders, so on-chain records and exchange records stay important long after the event. Exchanges and other virtual asset service providers that receive funds traced to an exploit may be asked for records by investigators.
Red flags in this case
- Deposits that trace back on-chain to a known exploit or hack address, even through several intermediate wallets
- Wrapped tokens converted into bitcoin or other assets soon after a large inflow from a decentralised finance protocol
- Funds split and moved through a chain of new addresses with no clear business purpose before reaching an exchange
- A customer who cannot explain the source of a large crypto balance that appeared suddenly
If this landed in your queue
- Run the deposit addresses through blockchain analytics and check for exposure to known exploit or hack addresses
- Ask the customer for the source of funds and evidence of how the assets were acquired
- Review the customer's full transaction history for conversions and transfers that look designed to hide the origin of funds
- Escalate for a suspicious activity report and consider holding the funds under your firm's policy if exposure to stolen funds is confirmed
Key terms
- Cross-chain bridge
- A service that lets users move crypto assets from one blockchain to another, usually by locking assets on one chain and issuing matching tokens on the other.
- Wrapped token
- A token on one blockchain that represents an asset from another, such as WBTC representing bitcoin on Ethereum.
- Extradition
- The formal handover of a person from one country to another to face criminal charges.
Interview angle
A customer's deposit is traced on-chain to a smart contract exploit that happened four years ago. Does the age of the theft change how you handle it?
Explain that stolen funds stay tainted regardless of age. Describe tracing the exposure, asking for source of funds, documenting the review and escalating for a suspicious activity report where warranted, and note that investigators may still pursue the case years later.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.