Free tools Windows power users keep installed
One-click scans. No signup required.
The FTC announced a proposed settlement with Illusory Systems, Inc., which does business as Nomad, over a 2022 cryptocurrency bridge hack. The agency says hackers took $186 million and consumers ultimately lost approximately $100 million after recoveries. The proposal would require a security program, independent assessments every two years, truthful security claims, and the return of recovered breach money not already returned. The FTC case page was still marked “Pending” in its December 16, 2025 update, so the public record cited here does not establish that the order is final.
What happened in the Nomad hack?
Nomad operated a cross-chain bridge that allowed users to transfer assets. In an administrative complaint, the FTC alleged that the company represented its service as secure but failed to use reasonable software-development practices. According to the complaint, inadequately tested code introduced in June 2022 contained a significant vulnerability, which hackers exploited just over a month later. The complaint also alleges shortcomings in secure coding, handling vulnerability reports, incident response, and technologies that could have limited consumer losses. These are allegations, not findings after a trial. Read the FTC complaint.
As an Amazon Associate I earn from qualifying purchases.
How much was taken, and how much did consumers lose?
The FTC reported that hackers stole $186 million. That is the amount reportedly taken, not the agency’s estimate of consumers’ net losses. The FTC said some funds were recovered and put consumer losses at approximately $100 million. Those figures come from the agency’s December 2025 announcement and should not be treated as interchangeable. See the FTC’s announcement.
Recommended Free Tools
What would the proposed FTC order require?
The FTC accepted the proposal for public comment and said it would review comments before deciding whether to make the order final. If finalized, the order would:
#1 Best Overall
- Prohibit Illusory Systems from misrepresenting its security practices.
- Require the company to establish a comprehensive information security program.
- Require independent third-party assessments every two years.
- Require it to return recovered money from the breach that has not already been returned to consumers.
The proposed requirements are described in the FTC announcement and the Federal Register notice.
Is the FTC settlement final?
Not according to the latest official case record cited here. The FTC case page listed the matter as Pending and showed a last update of December 16, 2025. The agency described a proposal accepted for public comment, with a final decision to follow review of those comments. The cited record does not establish that the order has since become final. Check the FTC case page for a later docket update.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the FTC said about security obligations
Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, said: “The FTC Act requires companies to take reasonable security measures.”
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
