Wanchain Cardano Bridge Hit In $13M Exploit

515 Million NIGHT Tokens Drained in Bridge Attack

Wanchain's bridge connecting Cardano to BNB Chain was exploited on July 21, 2026, with approximately 515.2 million $NIGHT tokens drained from the bridge treasury. The stolen tokens were worth roughly $13 million at pre-exploit prices. CoinGecko data showed the token trading near $0.0186 after the incident, placing the value of 515 million NIGHT closer to $9 million to $10 million at prevailing prices.

The incident unfolded in just four rapid transactions over an eight-minute window. BlockSec Phalcon traced the attacker's redeemer back to a legitimate BSC transaction that authorized only around 3,110 NIGHT, with the same signature then reused on Cardano to extract more than 203 million NIGHT through field-boundary ambiguity in the raw-concatenated hash. The attacker funneled stolen tokens into a primary wallet on Cardano before aggressively liquidating roughly 90% of the haul through DEX swaps and DeFi protocols.

Validator Flaw at the Root of the Exploit

BlockSec's monitoring revealed that the attack exploited a vulnerability in the TreasuryCheck validator's signature message encoding. The issue arose from the raw concatenation of 14 variable-length redemption fields without delimiters, allowing different field combinations to produce identical byte strings and reuse the same hash and signature. BlockSec confirmed the vulnerability by analyzing on-chain Plutus V2 bytecode and decoding the attack transaction's redemption data, noting that use of Sha3_256(SerialiseData(...)) could have prevented this by providing clear CBOR-encoded field boundaries.

Wanchain confirmed it was aware of an incident affecting the Cardano BNB Chain bridge, resulting in the withdrawal of NIGHT tokens from the bridge contract on Cardano, and said the bridge was taken offline while the team investigates. Midnight said its core network remained secure, describing the incident as isolated to bridge infrastructure.

NIGHT is Midnight's native governance token and also generates DUST, the network resource used for transactions and smart contract execution. Midnight operates as a privacy-focused Cardano partner chain with a dual-token economic model, and launched its mainnet in March 2026. NIGHT sold off sharply as reports of the bridge incident spread, falling more than 30% within 24 hours to a record low near $0.016.

Wanchain originally launched cross-chain support for NIGHT between Cardano and BNB Chain in December 2025. The latest bridge incident has brought renewed attention to the risks created when native assets move through third-party infrastructure.

Sources:
Crypto.news: Wanchain Cardano bridge exploit drains 515M NIGHT
CryptoTimes: Wanchain Cardano Bridge Exploited
Phemex News: Wanchain Cardano Bridge Hacked