Israel’s Supreme Court on March 8, 2026, upheld the decision to extradite Alexander Block—formerly known as Alexander Gurevich—to the United States, where he will face federal charges linked to a 2022 exploit of the Nomad crypto bridge. The court’s rejection of Block’s “code‑bug” defense marks a rare judicial affirmation that exploiting a smart‑contract flaw can constitute unlawful computer intrusion, even when the software technically permits the action.

Background of the Nomad Exploit

According to Decrypt, a June 2022 software update to Nomad’s smart contracts introduced a flaw that allowed users to receive tokens on one blockchain without first locking the equivalent assets on another chain. Block, operating under the username “Bitlik,” allegedly performed six test transfers before executing four larger withdrawals on or around August 1, 2022, netting more than $2.8 million in tokens. He then moved the assets through multiple wallets and swapped them into other cryptocurrencies to obscure their origin. The exploit was quickly replicated; other actors drained a Nomad‑controlled wallet holding over $186 million in user funds, a loss described by Paradigm researcher Sam Sun as a “frenzied free‑for‑all.”

Block was arrested at Ben Gurion Airport in May 2025 while preparing to fly to Russia, shortly after changing his surname and obtaining a new passport. The Jerusalem District Court approved his extradition in July 2025, and the U.S. had originally requested it in December 2024. An eight‑count indictment filed in August 2023 by the Northern District of California includes four counts of computer fraud, three counts of money laundering, and one count of transporting stolen property. Block’s lawyers argued that he only used functions available within Nomad’s automated system and that public blockchain records should exonerate him from money‑laundering claims. Justice Ofer Grosskopf, writing for the Supreme Court, rejected both arguments, likening the exploit to using a defective ATM to withdraw cash.

Implications for DeFi Regulation

The court’s decision provides a precedent for how Israeli law may treat DeFi vulnerabilities as criminal offenses, potentially influencing other jurisdictions. Unchained noted that the ruling answers a question it raised in 2022 about whether mass looting of DeFi protocols would alter law‑enforcement approaches. By classifying the exploitation of a smart‑contract bug as a form of illegal intrusion, regulators may feel empowered to pursue similar cases against actors who capitalize on code defects, even when the underlying software does not explicitly forbid the behavior.

What to Watch Next