Key Highlights
- Wanchain offered the Cardano bridge hacker a 10% white-hat bounty for returning 90% of the stolen NIGHT tokens.
- The protocol set an August 6, 2026 deadline and pledged not to pursue civil claims if the offer is accepted.
- Blockchain analytics firms and exchanges are monitoring the flagged wallets as recovery efforts continue.
Wanchain, a cross-chain bridge protocol, has publicly offered the perpetrator of its recent Cardano bridge exploit a white-hat recovery deal. The bridge was exploited on July 20, 2026, resulting in the theft of approximately 515.2 million NIGHT tokens, valued at around $10 million.
In a detailed X post on Thursday, Wanchain opened a communication channel to resolve the incident. The offer allows the hacker to retain 10% of the stolen NIGHT tokens as a white-hat bounty, provided they return the remaining 90% by August 6, 2026, at 12:00 UTC. If accepted, Wanchain will treat the incident as a white-hat recovery and refrain from pursuing civil claims.
The team has engaged blockchain analytics firms and flagged the relevant addresses with exchanges for monitoring. The funds can be returned to a specified Cardano address or an Ethereum address provided in the statement. The hacker can communicate by sending an on-chain message from the exploit wallet or emailing whitehat@wanchain.org.
How the exploit unfolded
Security firm BlockSec’s Phalcon monitoring system first flagged the exploit on July 21. The attack unfolded rapidly across four transactions in an eight-minute window. Analysts identified the root cause as a non-injective signed-message encoding flaw in the TreasuryCheck validator.
The vulnerability stemmed from raw concatenation of variable-length fields without proper delimiters, allowing signature reuse, a recurring weakness in cross-chain infrastructure. The attacker quickly moved the stolen NIGHT tokens into a primary Cardano wallet and liquidated roughly 90% of the haul through decentralized exchanges and DeFi protocols on the network. At the time of the exploit, NIGHT was trading around $0.01950 per token.
Wanchain acknowledged the incident, stating the Cardano-BNB Chain bridge had been temporarily disabled. “We are aware of an incident affecting the Cardano BNB Chain bridge… This has our full attention,” the team said, promising transparency and further updates.
Crypto hacks hit record high in H1 2026
The incident adds to the growing list of crypto hacks in 2026. On-chain security platform Blockaid reported that the first half of 2026 was the most exploited period, with total losses from security incidents surpassing $1.1 billion across 212 verified attacks.
According to the report, the number of high-threshold exploits in the first six months of 2026 was 3.4 times higher than the entire year of 2025. However, overall dollar losses were lower than the same period last year, largely because there was no single catastrophic breach on the scale of the $1.5 billion Bybit hack.
The four largest incidents dominated the damage: KelpDAO ($292 million) and Drift Protocol ($285 million), along with Resolv and CowSwap. Together, these four attacks accounted for approximately $707 million, or 64% of all losses during the period.
Blockaid also linked North Korean hacking groups, particularly the TraderTraitor subgroup of the Lazarus Group, to the KelpDAO, Drift Protocol, and Humanity Protocol exploits. Together, those attacks accounted for roughly $609 million, or about 55% of total losses in the first half of the year.
White-hat negotiations remain controversial
While Wanchain’s white-hat offer appears pragmatic, it also highlights deep systemic failures in the cross-chain sector. While such agreements can improve the chances of recovering stolen assets, they have also sparked debate over whether bounty offers incentivize attackers to negotiate after an exploit.
The incident also underscores the continuing security challenges facing cross-chain infrastructure. Bridge vulnerabilities have remained one of the largest sources of losses in the digital asset industry, exposing users and liquidity providers to significant risks.
As investigations continue, the outcome of Wanchain’s offer may influence how future bridge exploits are handled, but it also highlights the need for stronger security measures across cross-chain protocols.
Also Read: Chainalysis: FIFA World Cup Generated $20B in On-Chain Prediction Markets
