- Approximately 515 million NIGHT tokens, valued at around $9–10 million, were stolen from Wanchain’s Cardano–BNB Chain bridge treasury.
- Signed-message encoding flaw in Wanchain’s TreasuryCheck validator as the likely cause.
- Midnight Foundation confirmed the exploit was limited to Wanchain’s third-party bridge infrastructure and did not affect the Midnight blockchain.
- NIGHT fell more than 30% after the attacker reportedly sold a large portion of the stolen tokens on decentralized exchanges.
Wanchain bridge exploit hits Cardano–BNB Chain infrastructure
Wanchain @wanchain_org Cardano bridge was reportedly being attacked, with ~515M $NIGHT drained from the bridge Treasury.
Our initial investigation suggests that the root cause seems to be a non-injective signed-message encoding in the TreasuryCheck validator. The signed message… https://t.co/bnWEnw3Dxc pic.twitter.com/PQFAN6lRn9
— BlockSec Phalcon (@Phalcon_xyz) July 21, 2026
Wanchain’s Cardano-to-BNB Chain bridge suffered a major security exploit on July 21, resulting in the theft of approximately 515 million NIGHT tokens worth an estimated $9–10 million. The attacker drained the bridge’s Cardano-side treasury through four transactions completed within roughly eight minutes before moving and selling the stolen assets.
One of the exploit-related withdrawals was recorded on the Cardano blockchain under transaction hash 0a4861…ea1, providing an on-chain record of the bridge treasury withdrawal.
Security notice regarding the Cardano ↔ BNB Chain Bridge. pic.twitter.com/tUrSnXg5VN
— Wanchain (@wanchain_org) July 21, 2026
The incident immediately impacted the market, with the NIGHT token declining by more than 30% as significant selling pressure emerged across decentralized exchanges. The exploit targeted Wanchain’s cross-chain bridge infrastructure rather than the Cardano blockchain or the Midnight network itself, according to statements released following the incident.
The bridge enables users to transfer NIGHT tokens between Cardano and BNB Chain as part of Wanchain’s decentralized interoperability network, which connects multiple blockchain ecosystems using secure multiparty computation (sMPC) and Threshold Signature Scheme (TSS) technology.
Polychain-backed Cascade’s CLS vault was exploited, resulting in approximately $1.34 million in USDC losses, while Allbridge Core reportedly suffered a separate Solana pool exploit estimated at $1.65 million. The incidents add to a broader wave of DeFi security breaches targeting smart-contract vaults and cross-chain infrastructure.
The latest exploits follow Wanchain’s Cardano–BNB Chain bridge attack, in which approximately 515 million NIGHT tokens worth $9–10 million were stolen. Together, the incidents highlight continued security risks across decentralized finance and cross-chain protocols.
Early investigation points to validator message encoding vulnerability
Investigation suggests the exploit may have originated from a non-injective signed-message encoding vulnerability in Wanchain’s TreasuryCheck validator. According to the security firm’s analysis, multiple transaction fields were concatenated without sufficient separation or length encoding, potentially allowing different transaction inputs to produce the same signed message.
If confirmed, the flaw could have enabled an attacker to reuse a previously valid signature to authorize unauthorized withdrawals from the bridge treasury.
- Estimated assets stolen: 515 million NIGHT
- Estimated value: Around $9–10 million
- Attack duration: Approximately eight minutes
- Transactions involved: Four withdrawals
- Affected infrastructure: Wanchain Cardano–BNB Chain bridge treasury
- Blockchain status: Cardano and Midnight remained operational
Midnight distances network from bridge incident
🚨 Community Update:
We are aware of reports concerning an incident involving the Wanchain Cardano to BNB bridge affecting bridged NIGHT.
Based on the information currently available, this appears to relate to cross-chain bridge operations and not the @MidnightNtwrk itself. We…
— Midnight Foundation (@midnightfdn) July 20, 2026
The Midnight Foundation stated that the exploit was isolated to Wanchain’s third-party bridge infrastructure and did not compromise the Midnight blockchain, its validator network, consensus mechanism, or protocol infrastructure. The foundation also said no additional NIGHT tokens were minted and that the token’s total supply remains unchanged.
The incident comes months after Wanchain launched support for bridging NIGHT between Cardano and BNB Chain, expanding interoperability for Midnight’s native asset across ecosystems. Wanchain has positioned its bridge network as a decentralized interoperability platform secured through overcollateralized bridge nodes and threshold-signature technology.
The exploit also follows recent security-related actions within the Midnight ecosystem. In late June, the Midnight Foundation temporarily suspended Glacier Drop redemptions as a precaution after an unrelated security incident affecting certain Cardano wallets.
Redemptions resumed on July 9 after the foundation concluded there was no risk to Midnight’s redemption infrastructure. The latest bridge exploit is separate from that earlier incident, according to the foundation.
As of publication, Wanchain has not released a full technical postmortem detailing the attack path, potential recovery efforts, or remediation measures. The investigation remains ongoing as the company and external security researchers continue to analyze the exploit.
At 8:36 a.m. UTC, Midnight (NIGHT) was trading at $0.01909, according to CoinMarketCap, down 28.27% over the previous 24 hours. The token’s sharp decline came amid selling pressure following the Wanchain Cardano Bridge exploit, which resulted in the theft of approximately 515 million NIGHT tokens. Investors continued to monitor the project’s response and recovery efforts as the market reacted to the security incident.
