The $10M Wanchain Bridge Exploit: How a Signature Flaw Drained 515M NIGHT Tokens

An attacker withdrew approximately 515.2 million NIGHT tokens from the Cardano-side treasury of Wanchain’s Cardano–BNB Chain bridge in four transactions between 14:46 and 14:55 UTC on July 20, 2026.

Preliminary analysis by blockchain security firm BlockSec indicates that the bridge’s TreasuryCheck validator constructed signed messages by directly joining 14 variable-length fields without separators or length markers. That ambiguity allowed a legitimate signature authorizing roughly 3,110 NIGHT on BNB Chain to be reused for a Cardano withdrawal of 203,001,692 NIGHT, more than 65,000 times the intended amount.

The incident did not compromise Cardano’s consensus, Midnight’s protocol, or Wanchain’s validator private keys. It exploited how the bridge interpreted a correctly produced signature.

The Exploit at a Glance

Metric	Preliminary finding
Exploit window	July 20, 2026, 14:46–14:55 UTC
Total NIGHT withdrawn	Approximately 515.206 million
Estimated value	Roughly $9 million to $13 million, depending on the valuation time
Widely reported value	Approximately $10 million
Number of withdrawals	Four
Largest documented withdrawal	203,001,692 NIGHT
Original authorized transfer	Approximately 3,110 NIGHT
Suspected vulnerability	Non-injective signed-message encoding
Infrastructure affected	Wanchain’s Cardano–BNB Chain bridge
Infrastructure not affected	Cardano consensus and Midnight’s core protocol
Bridge status	Suspended while Wanchain investigates

9 Minutes That Emptied a Bridge Reserve

The transactions began at approximately 14:46 UTC on July 20.

Over the following nine minutes, roughly 515.2 million NIGHT moved from an address identified by on-chain researchers as Wanchain’s Cardano-side bridge reserve into an attacker-controlled wallet.

Community investigators divided the withdrawals into four tranches:

• Approximately 203 million NIGHT
• Approximately 129.6 million NIGHT
• Approximately 120.4 million NIGHT
• Approximately 62.1 million NIGHT

All four transfers arrived at the same primary wallet. The contract also contained other assets, including Mynth, XER, and WMT, but those tokens were not withdrawn, suggesting NIGHT was deliberately targeted rather than swept as part of a broader contract drain.

The significance of the withdrawal was greater than its headline dollar value.

Before the exploit, the Cardano-side address reportedly contained approximately 527 million NIGHT. Afterward, only about 12 million remained. On that basis, the incident removed almost 97.8% of the reserve supporting Wanchain-wrapped NIGHT on BNB Chain.

The stolen amount also represented approximately:

• 2.15% of NIGHT’s fixed 24 billion-token supply
• 3.1% of the roughly 16.61 billion NIGHT shown as circulating by Midnight

Those percentages help explain why a roughly $10 million exploit produced a market reaction usually associated with a much larger dollar loss. The attacker did not merely steal from a protocol treasury. The attacker gained control of a material share of the token’s liquid supply and began selling it into comparatively shallow markets. Midnight lists NIGHT’s total supply at 24 billion and describes it as the unshielded utility token that generates the network resource DUST.

How Did the Wanchain Signature Flaw Work?

The preliminary explanation is not that the attacker broke the cryptography behind Wanchain’s validator signatures. Instead, the attacker appears to have found two sets of transaction data that the bridge could not distinguish after encoding them.

BlockSec described the suspected vulnerability as non-injective signed-message encoding in a Cardano validator called TreasuryCheck.

In a properly designed signing process, every materially different withdrawal instruction should produce a different message and therefore a different hash. A signature approving one transaction should not validate another transaction with a different recipient, amount or source identifier.

According to BlockSec, TreasuryCheck constructed the message by concatenating 14 variable-length redeemer fields using an AppendByteString operation. The fields were placed next to one another without unambiguous separators or length prefixes.

A simplified example illustrates the danger:

• Fields 12 and 3 produce the combined string 123
• Fields 1 and 23 also produce the combined string 123

The structured inputs are different, but the final encoded message is identical.

When a signature is generated over the combined message rather than over a canonical representation that preserves each field’s boundaries, that signature may be valid for more than one interpretation of the transaction.

That appears to be the central failure in the Wanchain incident: the signature remained cryptographically valid while the meaning assigned to it changed.

From 3,110 NIGHT to 203 Million

BlockSec traced the uniqueId used in one exploit transaction to a legitimate BNB Chain transaction whose hash began 0xe901 and ended f26b.

That original transaction authorized the movement of approximately 3,110 NIGHT.

The attacker allegedly reused its valid signature on Cardano, but supplied a different arrangement of redeemer fields that the vulnerable encoding process reduced to the same signed byte string. The Cardano validator then accepted a withdrawal of 203,001,692 NIGHT.

The resulting withdrawal was about 65,274 times larger than the original transfer.

This distinction matters. Describing the incident simply as a “signature hack” can imply that an attacker forged a digital signature, stole signing keys or defeated the underlying signature algorithm.

The available evidence supports none of those conclusions.

The signature appears to have been genuine. The failure was that the bridge did not bind the signature to one—and only one—structured withdrawal instruction.

BlockSec said it reached its preliminary conclusion by decompiling the bridge’s on-chain Plutus V2 bytecode and decoding the redeemer supplied in the attack transaction. Wanchain had not published a final technical post-mortem as of July 22, so the analysis should still be treated as a leading forensic explanation rather than Wanchain’s final determination.

The Function That Could Have Prevented It

BlockSec identified another revealing detail in the validator code.

The contract reportedly contained Cardano’s SerialiseData function, but used it for matching output data rather than for constructing the hash that validators signed.

Cardano’s Plutus documentation describes serialiseData as a function that converts structured data into a CBOR-encoded byte string. Because that format preserves the structure and boundaries of the original data, it can prevent different field combinations from collapsing into the same message.

BlockSec said hashing a canonical serialization—such as Sha3_256(SerialiseData(…))—would have created unambiguous field boundaries and prevented this class of field-splitting signature reuse.

That does not mean this exact construction is the only safe design. Length-prefixed encoding, typed structures and domain-separated signing formats can also bind signatures to a precise message.

The broader rule is simpler: never ask validators to sign an ambiguous byte sequence assembled from variable-length fields.

Why Wanchain’s Validator Network Did Not Stop the Attack

Wanchain says its cross-chain products are secured by a group of 25 permissionless bridge nodes using secure multiparty computation and Shamir’s Secret Sharing. At least 17 of the 25 nodes must agree to execute a cross-chain transaction.

At first glance, that threshold should make unauthorized withdrawals difficult. An attacker would ordinarily need to compromise a large number of nodes or subvert the signing process. But threshold security only protects the production of a signature. It cannot correct ambiguity in the message being signed.

If 17 honest nodes approve message X, but the destination contract can interpret X as two different transactions, the threshold has successfully authenticated an unsafe message.

The Wanchain incident therefore exposes a less obvious bridge risk: projects often focus on how many validators hold signing authority while giving less attention to whether the signed payload has one canonical meaning on every supported blockchain.

That problem becomes particularly acute when a bridge translates data between networks with different execution models, programming languages and transaction structures.

The Tokens Were Moved, Not Newly Minted

Early speculation suggested that the attacker might have created hundreds of millions of additional NIGHT tokens.

On-chain analysis found no corresponding increase in NIGHT’s total supply. The attacker appears to have removed existing tokens from a reserve address rather than exploiting NIGHT’s minting policy.

That is reassuring for the integrity of NIGHT’s supply, but it does not eliminate the bridge’s accounting problem.

The reserve on Cardano served as backing for wrapped NIGHT issued on BNB Chain. When almost 98% of that collateral was removed, the bridge could no longer safely process normal redemptions without restoring the reserve, freezing the wrapped assets or introducing another recovery mechanism.

In a conventional lock-and-mint bridge, users deposit an asset into a contract on the source chain and receive a corresponding wrapped asset on the destination chain. The wrapped token’s economic value depends on the locked collateral remaining available for redemption.

A bridge can therefore become insolvent without minting a single unauthorized token. Draining the backing asset is enough.

This is one reason the unresolved condition of Wanchain-wrapped NIGHT on BNB Chain may ultimately matter more than the spot price’s initial recovery.

What Happened to the Stolen NIGHT?

The first wallet began routing and selling tokens soon after the withdrawals.

Preliminary community tracing identified roughly 300 million NIGHT sold across Cardano decentralized exchanges. Reported swaps included approximately 217.7 million NIGHT exchanged for 24.02 million ADA and 87.88 million NIGHT exchanged for about 1.44 million USDCx.

Around 200 million NIGHT was transferred to a second wallet believed by investigators to be controlled by the same entity. The wallets had exchanged ADA and NIGHT before and after the transfer, supporting—but not conclusively proving—the common-control theory.

Researchers also tracked approximately 68.27 million NIGHT deposited into the Liqwid lending protocol as collateral. The wallet reportedly borrowed around 4.36 million ADA against that position and moved the borrowed ADA back to the primary wallet.

That strategy allowed the attacker to extract liquidity without immediately selling every NIGHT token. It also introduced another layer of risk: if the collateral’s value declined enough, the position could be liquidated, adding further forced selling.

These figures originate from preliminary community tracing and may change as addresses are clustered, swaps are decoded and funds continue to move. Wanchain has not yet published a complete official accounting of the attacker’s wallets or realized proceeds.

Why the Loss Is Valued Between $9 Million and $13 Million

The number of tokens removed is comparatively clear. Their dollar value is not.

NIGHT traded through a sharp decline while the attacker was withdrawing and selling the assets. Multiplying 515.2 million tokens by a price near $0.0195 produces a value of approximately $10 million, the figure widely used in initial reports.

Other estimates valued the tokens closer to $13 million using the price before the sell-off, while later valuations placed them near $9 million after NIGHT fell.

The attacker’s realized proceeds may be lower still because decentralized liquidity was insufficient to absorb hundreds of millions of NIGHT without substantial slippage.

For that reason, three figures should not be treated as interchangeable:

1. The market value before the exploit
2. The quoted value when the withdrawals occurred
3. The amount the attacker ultimately realized after swaps, borrowing costs and slippage

Until a full fund-flow analysis is published, approximately $10 million is a reasonable headline estimate rather than a final recovery-accounting figure.

NIGHT’s Price Collapsed—and Then Rebounded

NIGHT traded above $0.026 before the selling accelerated. It subsequently fell to approximately $0.0152–$0.0158, depending on the data provider and exchange set used to calculate the low.

That represented a peak-to-trough decline of more than 40%. Trading volume increased sharply as the exploit-related supply hit the market and traders reacted to speculation that Midnight itself had been compromised.

NIGHT then recovered part of the decline, at one point rising roughly 28% to 35% from its lowest reported level.

The rebound suggests that some traders accepted the distinction between a failure in third-party bridge infrastructure and a failure of the underlying Midnight network. It does not, however, remove the remaining token overhang or resolve the missing bridge collateral.

Price recovery is not the same as infrastructure recovery.

Was Cardano or Midnight Hacked?

No evidence indicates that Cardano’s blockchain, consensus mechanism, or native-asset ledger was compromised.

The Midnight Foundation said the incident was isolated to Wanchain’s Cardano–BNB Chain bridge and that Midnight’s protocol, validator network, consensus mechanism and core infrastructure continued operating normally.

Cardano processed the exploit transactions according to the conditions encoded in the affected bridge validator. In other words, the blockchain executed the program it was given. The program’s authorization logic appears to have been defective.

That distinction is similar to an application running on a conventional operating system: a vulnerability in one application does not necessarily mean the operating system itself has been breached.

It is also important for classifying the incident accurately. This was apparently:

• Not a Cardano consensus failure
• Not a Midnight validator compromise
• Not an unauthorized increase in NIGHT’s total supply
• Not, based on current evidence, a theft of Wanchain validator keys
• A failure in a third-party cross-chain authorization mechanism

Wanchain and Midnight’s Response

Wanchain acknowledged unauthorized withdrawals from the Cardano bridge contract and made its bridge unavailable while investigating. The company said it would release further information after completing its review.

The Midnight Foundation separately warned users to rely on official communications and remain alert for phishing attempts seeking to exploit confusion around the incident.

Midnight later said exchanges including Binance, Kraken, KuCoin, Bybit, OKX, Gate, and MEXC had taken precautionary measures involving linked accounts and addresses. Reported actions included wallet blacklisting and temporary restrictions on NIGHT deposits or withdrawals where required. The amount of stolen NIGHT actually intercepted or frozen at centralized venues was not publicly disclosed.

Those controls may limit the attacker’s ability to convert assets through centralized exchanges. They cannot reverse trades already executed through decentralized protocols or automatically restore the bridge’s Cardano reserve.

As of July 22, Wanchain had not publicly released:

• A final technical post-mortem
• A definitive list of affected contracts and wallets
• The amount of recoverable or frozen funds
• A plan to restore backing for wrapped NIGHT
• A compensation framework
• A date for reopening the Cardano–BNB Chain route

A Different Kind of Bridge Failure

The largest bridge hacks of 2022 were frequently associated with compromised validator keys, weak multisignature arrangements or fraudulent cross-chain messages.

Chainalysis estimated in August 2022 that approximately $2 billion had been stolen through 13 bridge hacks, accounting for 69% of all cryptocurrency stolen during the year up to that point. It identified large pools of locked collateral and still-evolving bridge designs as central reasons bridges attracted attackers.

Bridge losses subsequently declined as several vulnerable architectures were hardened or retired. Immunefi estimated that bridge incidents fell from 73% of DeFi protocol losses in 2022 to 3% in 2025.

But the underlying cross-chain trust problem did not disappear. It moved into messaging layers, verifier configurations and application-specific authorization logic. Immunefi recorded a $292 million bridge-related loss in April 2026 involving a single-verifier configuration, while CertiK estimated that bridge-related incidents had caused more than $328 million in losses during 2026 by the time of its report.

The Wanchain exploit fits that newer pattern.

Its reported validator threshold was not obviously weak, and the attacker did not appear to defeat the signature algorithm. The vulnerability was buried in the semantic layer between the signed cross-chain message and the Cardano contract that interpreted it.

What Bridge Developers Can Learn

The immediate lesson is not simply that bridges need more validators. They need stronger guarantees about exactly what those validators authorize.

A secure cross-chain signing format should include:

Canonical structured encoding. Every field should be represented in a format that preserves its type, order and boundaries.

Domain separation. A signature created for one bridge, chain, contract version or transaction type should not be reusable in another context.

Explicit chain and contract identifiers. The signed payload should bind the authorization to both the source and destination environments.

Replay protection. Unique identifiers should be marked as consumed and should not become reusable merely because another collection of fields produces the same hash.

Invariant testing. Audits should verify not only that valid messages succeed, but also that no two materially different withdrawal instructions can produce the same signed payload.

Independent reconciliation. Bridge systems should continuously compare locked collateral with wrapped liabilities and automatically pause when the relationship diverges.

The Wanchain case also illustrates why bridge audits must cover the complete off-chain and on-chain message lifecycle. Reviewing the destination contract in isolation is insufficient if the security assumption depends on how source-chain events are encoded, signed, transmitted and reconstructed.

The Questions Wanchain Still Must Answer

BlockSec’s analysis offers a technically plausible explanation, but it is not a substitute for an official post-mortem.

Wanchain’s eventual report will need to establish when the vulnerable validator was deployed, whether the code had been independently audited and whether the same message-construction logic exists in other bridge routes or assets.

It must also clarify whether all four withdrawals used the same field-boundary technique, why monitoring controls did not stop the sequence after the first 203 million-token transaction and how the platform intends to restore the relationship between Cardano reserves and wrapped NIGHT liabilities on BNB Chain.

The largest unanswered question is who absorbs the loss.

The core Midnight network may be secure, and the NIGHT supply may be unchanged, but a third-party bridge reserve that was almost completely emptied still represents an economic shortfall. Until Wanchain explains how that deficit will be covered, the incident remains unresolved regardless of whether NIGHT’s market price rebounds.

Conclusion

The Wanchain incident was not an example of cryptography being mathematically defeated. It was an example of cryptography being applied to an inadequately defined message.

Seventeen validators can honestly sign the same data. A signature algorithm can operate exactly as designed. A blockchain can process every transaction correctly. Yet hundreds of millions of tokens can still leave a treasury if the system fails to guarantee that the signed data has only one possible meaning.

That is what makes the NIGHT exploit more instructive than its approximately $10 million price tag.

It demonstrates that cross-chain security does not end with decentralizing the signers. It depends equally on the encoding, interpretation and accounting rules surrounding every signature they produce.

Until those layers are designed as one security system, bridges will continue to create places where individually secure blockchains become collectively vulnerable.

Frequently Asked Questions