Wanchain-Cardano Bridge NIGHT Token Exploit (July 2026)
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: Blockonomi confirms the full claim: ~515M NIGHT tokens (~$13M) were drained from Wanchain's Cardano-BNB bridge on July 21, 2026, via a TreasuryCheck validator signature-encoding flaw, with a signature authorizing ~3,110 NIGHT replayed to withdraw more than 203M NIGHT in a single transaction. Trust score now 4. Version history →
Incidents are rated for severity, not trust. The trust score is on Wanchain.
Summary
On July 20–21, 2026, an attacker exploited a cryptographic signature-reuse vulnerability in the Wanchain-operated cross-chain bridge connecting Cardano and BNB Chain, draining approximately 515 million NIGHT tokens valued between $9 million and $13 million at the time of theft. The vulnerability resided in the bridge's TreasuryCheck validator, which concatenated 14 variable-length transaction fields without delimiters, allowing a legitimate small-value signature to be replayed against a vastly larger withdrawal. The underlying Midnight blockchain and Cardano networks were not compromised; the breach was isolated to Wanchain's third-party bridge infrastructure.
Connected Entities
14 entities · 60 linked investigations- Ronin Bridge→mentioned with→Binance(65%)
- Injective Protocol→mentioned with→KuCoin(65%)
- Injective Protocol→mentioned with→Binance(80%)
- Injective Protocol→mentioned with→Kraken(60%)
- BNB Chain Bridge→mentioned with→Wormhole(60%)
- BNB Chain Bridge→mentioned with→Binance(70%)
- Midnight→mentioned with→Cardano(80%)
- Midnight Network / NIGHT Token→mentioned with→Cardano(70%)
- Midnight Network / NIGHT Token→mentioned with→Midnight(70%)
- Midnight Network / NIGHT Token→mentioned with→Kraken(65%)
- + 27 more
Connected Through
13 shared actors · 618 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Binanceorganization
- ♦KuCointoken
- □Krakenorganization
- □Wormholeorganization
Community submissions
- https://blockonomi.com/13m-wanchain-bridge-hack-drains-515m-night-tokens-via-signature-exploit(blockonomi.com)
“[Scout] Blockonomi reports attackers extracted approximately 515 million NIGHT tokens (about $13 million) from the Wanchain-operated Cardano bridge by exploiting a non-injective signed-message encoding flaw in the TreasuryCheck validator, replaying a valid signature that had authorized about 3,110 NIGHT tokens to withdraw more than 203 million NIGHT tokens in one transaction.”
— avoid-scout(unverified)
- Wanchain Cardano Bridge (NIGHT Token Exploit, July 2026)(www.cryptotimes.io)
“[Scout] CryptoTimes reports that on July 21, 2026, Wanchain's bridge connecting Cardano to BNB Chain was exploited, resulting in the theft of approximately 515.2 million NIGHT tokens (about $10 million) from the bridge treasury, due to a non-injective signed-message encoding flaw in the TreasuryCheck validator. The Midnight team said this does not reflect any vulnerability in the underlying Midnight blockchain.”
— avoid-scout(unverified)
6 submissions awaiting moderator review.
Timeline(5 events)
17 July 2026
Cardano executes the van Rossem hard fork (protocol version 11), expanding Plutus smart-contract functionality — three days before the exploit.
CryptoSlate20 July 2026
Attacker executes four transactions between approximately 14:46 and 14:55 UTC, draining approximately 515.2 million NIGHT tokens from the Wanchain Cardano-to-BNB Chain bridge treasury in roughly eight to nine minutes. The exploit is attributed to a non-injective signed-message encoding flaw in the TreasuryCheck validator.
CryptoTimes (technical analysis) / Blockonomi21 July 2026
Wanchain publicly acknowledges the breach and takes the Cardano-BNB Chain bridge offline. NIGHT token falls to an all-time low near $0.015–$0.016, a decline of 28–43% intraday. BlockSec's Phalcon monitor issues preliminary analysis. Midnight Foundation confirms Midnight blockchain is unaffected.
CryptoTimes / CoinGape / TokenPost22 July 2026
NIGHT token rebounds approximately 19% from session lows. Charles Hoskinson comments publicly, calling for industry-wide shift to zero-knowledge proof-based bridge infrastructure. CoinDesk reports on the rebound and Hoskinson's statements.
CoinDesk26 July 2026
CryptoTimes reports the industry lost over $47 million across multiple hacks in a single week, citing Wanchain, AFX Trade, and Verus as among the affected projects.
CryptoTimesDecision Log
- slot 457804025 · hash 7GowHZRTepWat5gaLAkPcs9DJNVrmteaZGQeL4He8DMe
- slot 457800111 · hash 7xyUEQkUS8MPNXRWJEK2YSkRHqh8KWCLYePSbau8BNgt
- slot 457787227 · hash EfnEunhf9BEqVPZAH7XMDyNpCiuCoysfjNHuVtCEq5Xp
- slot 443506735 · hash 5a7SPnzagLL2gkqJP9nVtxgSh9cTbnbWmAb3tgwV1UES
- slot 443506732 · hash DZMXNsGuf3qjdw1vNVfLpQtjAdpK6JL6ksZDjz5r9hgD
- slot 443502415 · hash AcUvnWV8D1Lj9NmUV7bt227WgjpQ7MJEJfv6YGywP73u
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 16 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:15:54 PM
last updated: 10/16/2026, 10:28:22 PM
5 viewsavoid.net — verified advice for a post-truth world