Wanchain Cardano bridge loses $13M as attacker inflates NIGHT signature 65,000x
- An attacker exploited a signature-reuse flaw in the Wanchain-operated Cardano to BNB Chain bridge on July 21, 2026.
- The attack drained about 515 million NIGHT tokens worth roughly $13 million and pushing the token to a record low near $0.016.
- The Midnight Foundation says its own network, validators, and consensus were not affected.
Major exchanges have started to freeze deposits and withdrawals of NIGHT token after approximately 515 million tokens (worth ~$13 million) were stolen by an attacker from the Wanchain-operated bridge linking Cardano and BNB Chain on July 21, 2026.
The NIGHT has since lost around 30% of its value since the theft was reported, hitting a record low of $0.016.
Wanchain released a security notice on X, stating it was looking into the matter and had pulled the bridge offline. KuCoin, Kraken, Binance, Bybit, OKX, and MEXC are all working with the Midnight Foundation on a coordinated response to mitigate the impact of the attack.
What went wrong with Wanchain?
According to an on-chain forensics firm, BlockSec Phalcon, the attack could be traced to how the bridge built the message that its validators sign. The flaw was in the TreasuryCheck validator, a component that linked 14 variable-length data fields into a single message without any delimiters or length markers between them.
The design enabled different combinations of field values to produce the same bytes and the same hash, thereby allowing signature reuse.
The effect was enormous. A valid signature had authorized the transfer of 3,110 NIGHT. The same signature was reused by the attacker to steal over 203 million NIGHT in one transaction.
Wanchain hasn’t experienced a breach like this in over eight years of the company running cross-chain bridges across dozens of blockchains in that period.
Midnight’s network remains unaffected
The Midnight Foundation looked to quickly dispel any rumors about its own infrastructure. In a post on X, it claimed the bridge failure was an isolated incident and did not involve the Midnight network.
The distinction is important, as holders are instinctively gauging their exposure after such an event. The theft affected bridged NIGHT traded on the Cardano and BNB Chain, without affecting tokens on Midnight’s infrastructure.Â
The question on everyone’s mind is recovery. Every trader is anticipating Wanchain’s explanation on how the flaw can be fixed and if, at all, any money can be recovered. NIGHT has already seen its trading volume plummet as the market awaits a firm response from the company.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
How much was stolen from the Wanchain Cardano bridge?
Attackers drained approximately 515 million NIGHT tokens, worth around $13 million, from the bridge treasury.
Was the Midnight network itself hacked?
No. The Midnight Foundation said the incident was isolated to the Wanchain Cardano–BNB bridge and that Midnight's protocol, validator network, consensus, and core infrastructure remained secure.
How did the attacker carry out the exploit?
BlockSec Phalcon identified a non-injective signed-message encoding flaw in the TreasuryCheck validator, which let the attacker reuse a signature authorizing about 3,110 NIGHT to extract more than 203 million NIGHT in a single transaction.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
