Israel Extradites Nomad Suspect After Supreme Court Rejected His Code-Bug Defense

Introduction

In a landmark decision, Israel’s Supreme Court dismissed the argument that exploiting a smart‑contract vulnerability is fundamentally different from using a software bug in any other program. The ruling cleared the way for the extradition of Alexander Block—formerly known as Alexander Gurevich—to the United States, where he faces an eight‑count federal indictment tied to the August 2022 hack of the Nomad crypto bridge.

The legal backdrop

Block was arrested at Ben‑Gurion Airport in May 2025 while attempting to board a flight to Russia. After a July 2025 district‑court finding that he was extraditable, the case reached Israel’s highest court. The Supreme Court panel, led by President Isaac Amit, upheld the lower‑court decision on March 8 2026 and refused Block’s request for a further hearing. The court’s reasoning was clear: exploiting a flaw in a decentralized finance (DeFi) smart contract is no more permissible than exploiting a defect in any other software system.

What the U.S. alleges

The Northern District of California filed an eight‑count indictment on August 16 2023, accusing Block of:

• Three counts of money laundering;
• Four counts of computer fraud; and
• One count of transporting stolen property.

According to the indictment, Block discovered a loophole in Nomad’s `process()` function that bypassed the usual `proveAndProcess()` verification step. By depositing funds into Nomad’s wallet repeatedly, he concealed his activity while testing the gap. In early August 2022 he executed four withdrawals totaling over $2.8 million, subsequently laundering the proceeds through a series of addresses and token swaps.

The exploit quickly spread. Other users copied the technique, draining an additional $186 million from the bridge. Block later attempted to negotiate with Nomad officials, offering to return the stolen tokens in exchange for a payment, but the talks stalled and the matter was referred to U.S. authorities.

The court’s reasoning

Justice Ofer Grosskopf, writing for the Supreme Court, rejected Block’s claim that he merely used the contracts as written. He likened the situation to an ATM that, due to a manufacturing defect, dispenses cash for a blank receipt—using the defect does not absolve the user of criminal liability. The court also dismissed the argument that blockchain’s public ledger precludes money‑laundering, noting that while transactions are visible, the identities behind wallet addresses remain opaque.

Implications for DeFi and law enforcement

The decision signals a shift in how jurisdictions may treat DeFi exploits. By equating smart‑contract bugs with conventional software vulnerabilities, courts are signaling that the legal framework governing traditional cybercrime extends to decentralized platforms. This could embolden law‑enforcement agencies to pursue similar cases worldwide, reducing the perceived “gray area” that many hackers have relied upon.

Practical outlook

Block has not yet appeared in a U.S. court, and a trial date remains unannounced. However, the extradition sets a precedent that may influence future cases involving cross‑border crypto crimes. Stakeholders in the DeFi ecosystem—developers, auditors, and users—should anticipate tighter scrutiny and a growing expectation that security flaws will be treated as criminal opportunities rather than merely technical oversights.

--- This article was prepared with AI assistance and reviewed by Unchained editorial staff.