Wanchain Cardano Bridge Exploited, 515M NIGHT Drained From Treasury

• BlockSec linked the exploit to a suspected signature validation flaw in Wanchain’s TreasuryCheck validator.
• Midnight said the incident only affected Wanchain’s bridge infrastructure, not the Midnight blockchain.
• NIGHT fell over 30% as investigators examined the reported $9 million bridge treasury drain.

A reported exploit targeting Wanchain’s Cardano-to-BNB Chain bridge has drained approximately 515 million NIGHT tokens from the bridge treasury. Blockchain security firm BlockSec said its preliminary investigation points to a flaw in the bridge’s signature validation process, while the Midnight Foundation clarified that the incident did not affect the Midnight Network itself.

BlockSec Identifies Possible Signature Validation Flaw

Blockchain security firm BlockSec reported on X on July 21 that attackers drained around 515 million NIGHT tokens from Wanchain’s Cardano bridge treasury. The stolen assets were valued at roughly $9 million based on prevailing market prices during the reported incident.

According to BlockSec, the suspected vulnerability exists within the bridge’s TreasuryCheck validator responsible for transaction signature verification. The firm emphasized that its findings remain preliminary while technical investigations continue.

Wanchain @wanchain_org Cardano bridge was reportedly being attacked, with ~515M $NIGHT drained from the bridge Treasury.

Our initial investigation suggests that the root cause seems to be a non-injective signed-message encoding in the TreasuryCheck validator. The signed message… https://t.co/bnWEnw3Dxc pic.twitter.com/PQFAN6lRn9

— BlockSec Phalcon (@Phalcon_xyz) July 21, 2026

The validator reportedly constructs signed messages by concatenating fourteen variable-length redeemer fields without separators or length prefixes. 

Consequently, different combinations of field values can produce identical byte strings and matching cryptographic hashes.

That structure may allow attackers to reuse an existing valid signature for unauthorized transactions under specific conditions. BlockSec verified its findings after examining the on-chain Plutus V2 smart contract bytecode and decoding the exploit transaction.

Researchers added that using serialized data with explicit field boundaries would have prevented ambiguous message encoding. 

Such an approach would eliminate opportunities for signature reuse through manipulated field combinations during transaction validation.

Midnight Confirms Core Network Remains Secure

The Midnight Foundation responded shortly after reports of the bridge exploit emerged across the cryptocurrency industry. It stated the incident remained isolated to Wanchain’s Cardano-to-BNB bridge infrastructure rather than Midnight’s blockchain.

According to the foundation, Midnight’s protocol, validator network, consensus mechanism, and core infrastructure continue operating normally without compromise. It added that the investigation focuses exclusively on third-party bridge infrastructure supporting cross-chain NIGHT transfers.

The organization also confirmed it continues working with Wanchain as the bridge operator investigates the reported exploit. Neither party has released a complete technical postmortem or recovery plan at the time of publication.

This distinction remains significant because cross-chain bridges operate independently from the underlying blockchain securing native digital assets. Therefore, vulnerabilities affecting bridge infrastructure do not automatically indicate failures within the associated blockchain network.

Bridge Exploit Triggers Sharp NIGHT Price Decline

The reported exploit triggered heavy selling pressure across cryptocurrency markets as traders reacted to the treasury drain. NIGHT declined by more than 30% within twenty-four hours following disclosure of the reported attack.

Wanchain launched the Cardano-to-BNB Chain bridge for NIGHT during December 2025 to support cross-chain asset transfers. The bridge locks native tokens while issuing equivalent wrapped assets for use across supported blockchain networks.

Cross-chain bridges frequently remain attractive targets because they secure substantial pools of digital assets supporting wrapped token issuance. Consequently, weaknesses within bridge validation logic have repeatedly resulted in significant cryptocurrency losses across multiple blockchain ecosystems.

Investigations into the reported exploit remain ongoing, while Wanchain has yet to publish a detailed explanation of the vulnerability. 

Until then, the full impact, potential recovery efforts, and any additional security measures remain under review.