Wanchain Cardano bridge exploit drains 515M NIGHT worth $9M

Wanchain's Cardano-to-BNB Chain bridge has reportedly suffered an exploit that drained about 515 million NIGHT from its Cardano-side treasury, according to blockchain security firm BlockSec.
Summary

• BlockSec said roughly 515 million NIGHT left Wanchain's Cardano bridge treasury during the reported exploit.
• Midnight said its core network remained secure, describing the incident as isolated to bridge infrastructure.
• NIGHT fell more than 30% as investigators examined possible signature reuse in Wanchain validator logic.

The incident triggered heavy selling of Midnight's native token and sent NIGHT down more than 30% within 24 hours.

BlockSec's Phalcon said its initial investigation pointed to a possible flaw in the TreasuryCheck validator used by the bridge. The security firm stressed that its findings remain preliminary. Meanwhile, the Midnight Foundation said the incident affected third-party bridge infrastructure rather than the Midnight blockchain itself.

BlockSec points to possible signature reuse flaw

According to BlockSec, the reported Wanchain Cardano bridge exploit may stem from the way the TreasuryCheck validator creates messages for signing. The firm said the validator combines 14 fields of varying lengths without adding clear separators or recording the length of each field. That structure could allow different sets of data to produce the same final byte string.

BlockSec said this could create a path for a signature reuse attack. An attacker may be able to reorganize field values while keeping the same signed message, allowing a previously valid signature to authorize a different transaction.

The firm said it reached its initial view after examining the onchain Plutus V2 code and the transaction linked to the reported attack. The investigation remains ongoing, and Wanchain had not published a full technical postmortem at the time of writing.

The security firm said a more structured encoding method could have prevented this type of ambiguity. Its analysis noted that the contract already contained Cardano's SerialiseData function, but the bridge did not appear to use it when building the signature hash. BlockSec said encoding each field with clear boundaries would prevent two different data sets from producing an identical signed message.

Wanchain originally launched cross-chain support for NIGHT between Cardano and BNB Chain in December 2025. The bridge allows users to move the token between the networks through cross-chain infrastructure operated by Wanchain. Cardano's official ecosystem directory describes WanBridge as using threshold-signature relayers to connect Cardano with EVM and non-EVM networks.

Midnight says the core network remains secure

The Midnight Foundation initially said it was investigating reports of an incident involving the Wanchain Cardano-to-BNB bridge and bridged NIGHT. It later issued a clarification saying the event was limited to Wanchain's third-party bridge infrastructure.

"The incident is isolated to the Wanchain Cardano--BNB bridge and does not involve the Midnight Network itself," the foundation said.

It added that Midnight's protocol, validators, consensus system and core infrastructure continued to operate normally. The organization said it was working with Wanchain as the bridge operator continued its investigation.

The distinction matters because the reported attack involved tokens held to support cross-chain transfers rather than a change to NIGHT's total supply. NIGHT is Midnight's native governance token and also generates DUST, the network resource used for transactions and smart contract execution. Midnight lists the token's total supply at 24 billion.

Midnight operates as a privacy-focused Cardano partner chain with a dual-token economic model built around NIGHT and DUST. The project launched its mainnet in March 2026, while NIGHT remains publicly transferable and tradable.

NIGHT sinks as hundreds of millions of tokens move

NIGHT sold off sharply as reports of the bridge incident spread. CoinGecko data showed the token trading near $0.0186, down about 31% over 24 hours. At those prices, 515 million NIGHT would carry a market value of roughly $9 million to $10 million. The value can move quickly because of the token's volatility.

The large movement of NIGHT created immediate selling pressure because hundreds of millions of tokens reportedly left the bridge treasury within a short period. However, the Midnight Foundation has not said that the Midnight protocol itself created new tokens or suffered a consensus failure. Its statements have consistently described the event as a cross-chain bridge issue.

The price decline reversed part of NIGHT's earlier market gains since Midnight's launch. As crypto.news reported in March, NIGHT rose more than 20% around the mainnet rollout. The token has since faced a more volatile market, and the latest bridge incident has brought renewed attention to the risks created when native assets move through third-party infrastructure.

Bridge security remains a recurring problem across crypto

The reported Wanchain incident follows several bridge attacks in 2026. As previously reported, Taiko halted parts of its network after a verification problem affected its bridge system. Other recent incidents involved Verus Protocol, Axelar-linked routes and older Aztec infrastructure.

A separate crypto.news guide on cross-chain bridge security explains that bridges often hold large pools of assets while relying on complex systems to verify transactions between networks that cannot communicate directly. Weaknesses in message validation, signer systems and smart contract logic have repeatedly provided attack routes.

The Wanchain case remains under investigation. BlockSec has presented a possible technical cause, while Midnight has limited its confirmed assessment to the bridge layer. Wanchain still needs to provide a full account of the transaction flow, the exact vulnerability, the status of bridged NIGHT.