The reported mechanism
Coinbase’s incident analysis describes a validation path that accepted fraudulent messages after an upgrade interacted with an initialized zero root. It also describes many addresses reusing similar transaction inputs with changed recipients.
Read Coinbase: Nomad Bridge incident analysis ↗How to approach the investigation
Compare implementation history, the message-validation path and the actual token movements. Similar payloads can reveal a repeated method, but do not prove that all participating addresses had one controller.
Evidence boundary
Learn the relevant method ↗This is an attributed reading note. The atlas does not independently reproduce the historical contract state or assign real-world identities to participants.