The Federal Trade Commission (FTC) announced a proposed consent order with Illusory Systems Inc. (Illusory), a Utah-based blockchain infrastructure company that operates the Nomad Token Bridge. The settlement resolves the FTC’s allegations that Illusory failed to live up to its stated data security commitments, leading to a 2022 cyberattack in which hackers stole approximately $186 million in crypto assets from platform users. Under the proposed order, Illusory must return to consumers any recovered funds and implement enhanced information security measures.

According to the FTC, in June 2022 the company deployed inadequately tested code containing a significant vulnerability, which allowed users to transfer messages and cryptocurrency. In August 2022, hackers allegedly exploited the flaw in the code to drain the bridge of assets, resulting in an estimated $186 million loss with approximately $100 million still unrecovered.

In its complaint, the FTC alleged that Illusory engaged in deceptive and unfair practices in violation of Section 5 of the FTC Act by representing that it prioritized “security-first” and that it took advantage of “every tool that protects users,” while allegedly failing to implement basic security measures. Specifically, the FTC contended that Illusory did not employ secure coding practices, lacked sufficient processes for receiving and remediating vulnerability reports, and did not maintain adequate incident response capabilities or staffing. The FTC’s two sitting Republican commissioners voted unanimously to approve issuance of the proposed complaint and order, which is now subject to a 30-day public comment period.

Under the proposed consent order, Illusory must implement a comprehensive information security program designed to protect against theft and other unauthorized access and address the specific security concerns identified in the FTC’s complaint. The company is also required to undergo independent, biennial assessments of its information security program and to cooperate with the third-party assessor.

This action reflects the FTC’s longstanding focus on cybersecurity practices, particularly where companies market their cybersecurity as an attribute to develop business and sell products and services. This settlement also highlights the increasing sophistication of regulators when it comes to identifying perceived deficiencies and risks in rapidly evolving technologies, such as blockchain. Firms offering digital asset or infrastructure services should closely evaluate their software development lifecycles, vulnerability management, staffing, and incident response capabilities, as well as the accuracy of their security-related disclosures. Regular review and testing of security practices can help mitigate regulatory and litigation risk as enforcement in this space continues to evolve.