Israeli man extradited to face charges in $2.89M Nomad bridge theft

The Justice Department said Alexander Gurevich, an Israeli national, appeared in federal court in the Northern District of California today after being extradited to face charges that he drained $2.89 million from the Nomad Bridge. The case treats a smart contract exploit as a computer crime and a money laundering offense, which matters to bridge operators, exchanges and compliance teams that handle traced funds.

• Gurevich, 49, is charged under a 2023 indictment with damaging a protected computer, interstate transportation of stolen money and money laundering.
• Prosecutors allege four exploit transactions on or about Aug. 1, 2022 moved 103 WBTC and 300 WETH, valued at about $2,894,390.
• The release gives no next court date, plea or detention ruling, so the schedule is the item to watch.

• $2.89M alleged haul, roughly 1.5% of the $190M widely reported lost in the Nomad hack
• 4 alleged exploit transactions, moving 103 WBTC and 300 WETH in total
• 20 years maximum for money laundering, double the 10-year maximum on each other count
• May 2025 arrest in Israel, before the recent extradition

The Justice Department announced the case in a release. It says Gurevich was arrested in Israel in May 2025 and “recently” extradited, without giving the extradition date. The indictment dates to 2023.

The release alleges that Gurevich sent the assets from Nomad’s address to an address he controlled through “unauthorized and non-authenticated transactions.” It further alleges he then converted the proceeds into other virtual currencies, including Bitcoin, and moved them across multiple addresses to conceal their nature, location, source, ownership and control.

What the charges carry

The release lists the counts as causing damage to a protected computer, interstate transportation of stolen money, and money laundering. Maximums are 10 years and a $250,000 fine for each of the first two, and 20 years and a $250,000 fine for laundering.

Gurevich is charged with causing damage to a protected computer, interstate transportation of stolen money, and money laundering.

Justice Department release

The listed maximums sum to 40 years, but the release gives no aggregate and no sentencing range. The matter is contested only in the sense that it is charged and unadjudicated. The release states that “an indictment is merely an allegation” and that defendants are presumed innocent.

Small slice of a much larger hack

Public reporting at the time put total losses from the Aug. 1, 2022 Nomad exploit at about $190 million, with many wallets copying the exploit once it became public. The $2.89 million charged here is about 1.5% of that total, so the indictment covers one alleged participant rather than the whole incident.

The release does not say whether other people have been charged, whether any assets were recovered, or whether the 103 WBTC and 300 WETH were frozen or seized. It also does not say how the proceeds moved after the Bitcoin conversion, or where Gurevich is held pending the next hearing.

What changes for operators and compliance teams

The charging language frames the transfers as unauthorized and non-authenticated, not as permitted by the contract’s code. That framing gives prosecutors computer-damage and stolen-money counts without a dispute over whether the code allowed the withdrawals. Defense arguments on that point would surface only if the case is contested.

The laundering count carries the heaviest listed penalty. The allegations that he converted into other assets and spread funds across addresses are the basis for it. For exchanges and bridge operators, the timeline is the practical lesson: conduct in August 2022, an indictment in 2023, an arrest in May 2025 and a U.S. appearance after a recent extradition. The release credits the Office of International Affairs and Israeli authorities with “substantial assistance.”

The BlockWest read. We think the laundering count, not the exploit count, is where this case sets the template. Converting stolen tokens into Bitcoin and scattering them across addresses is the standard cleanup after a bridge exploit, and the Justice Department is charging that cleanup as a separate crime with twice the maximum sentence. Operators should expect investigators to treat every post-exploit hop as evidence, and expect cross-border extradition to run on a clock of years rather than months.

Watch the Northern District of California docket for Gurevich’s plea and scheduling; the release names prosecutors Jessica Peck and Ethan Cantor but gives no next court date.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.