← Wanchain-Cardano Bridge NIGHT Token Exploit (July 2026)reviewed 2026-10-16 · 26 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Wanchain-Cardano Bridge NIGHT Token Exploit (July 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 5unverifiable 1stale 2link rot 1partially supported 2confirmed 158 corrections pending · 0 applied
disputed
5 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #7[disputed][awaiting moderator]in section: Market Impact and Price Action
“Despite the exploit, ADA (Cardano's native token) rose approximately 8% and approached $0.20 during the same period, as markets appeared to distinguish between the bridge infrastructure failure and the underlying blockchain's health.”
reviewerDespite the exploit, ADA rose approximately 8% and approached $0.20 during the same period.The 8% rise figure is correct, but the cited source and corroborating reporting put ADA around $0.175-0.178 on July 21, 2026, not 'approaching $0.20'.Proposed correction (not yet applied)Despite the exploit, ADA (Cardano's native token) rose approximately 8% and approached $0.18 during the same period, as markets appeared to distinguish between the bridge infrastructure failure and the underlying blockchain's health. - #8[disputed][awaiting moderator]in section: Market Impact and Price Action
“The divergence was partly attributed to Cardano's execution of the van Rossem hard fork (protocol version 11) three days prior to the exploit, which expanded Plutus smart-contract functionality.”
reviewerThe divergence in ADA/NIGHT price action was partly attributed to the van Rossem hard fork (protocol version 11), executed three days prior to the exploit.The hard fork activated July 18, 2026, roughly 41 hours (about two days) before the exploit began at 14:46 UTC July 20, 2026, not three days.Proposed correction (not yet applied)The divergence was partly attributed to Cardano's execution of the van Rossem hard fork (protocol version 11) two days prior to the exploit, which expanded Plutus smart-contract functionality. - #9[disputed][awaiting moderator]in the timeline
“2026-07-17”
reviewerCardano executes the van Rossem hard fork (protocol version 11) on July 17, 2026, three days before the exploit.Timeline date field is one day off from the confirmed mainnet activation date.Proposed correction (not yet applied)2026-07-18 - #10[disputed][awaiting moderator]in the timeline
“Cardano executes the van Rossem hard fork (protocol version 11), expanding Plutus smart-contract functionality — three days before the exploit.”
reviewerThe van Rossem hard fork event description states it occurred three days before the exploit.Same underlying date error as the timeline date field and the two section-level mentions; grouped under one defect.Proposed correction (not yet applied)Cardano executes the van Rossem hard fork (protocol version 11), expanding Plutus smart-contract functionality — two days before the exploit. - #11[disputed][awaiting moderator]in section: Broader Industry Context
“The Cardano van Rossem hard fork, executed three days before the exploit, was unrelated to the breach.”
reviewerThe Cardano van Rossem hard fork, executed three days before the exploit, was unrelated to the breach.Repeats the same hard-fork date error present in the timeline and in the Market Impact section.Proposed correction (not yet applied)The Cardano van Rossem hard fork, executed two days before the exploit, was unrelated to the breach.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #12[unverifiable][awaiting moderator]in section: Midnight Foundation and Cardano Network Response
“The statement read in part: "This incident does not reflect any vulnerability in the underlying Midnight blockchain."”
reviewerThe Midnight Foundation's statement read in part: 'This incident does not reflect any vulnerability in the underlying Midnight blockchain.'The substance (bridge isolated from core Midnight network) is well corroborated, but this specific verbatim quotation could not be located in the cited sources or elsewhere.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #3[stale][awaiting moderator]in section: Incident Overview
“As of late July 2026, no compensation plan had been formally announced and the bridge remained offline.”
reviewerAs of late July 2026, no compensation plan had been formally announced and the bridge remained offline.A compensation/settlement framework was in fact publicly announced on July 31, 2026 (still within 'late July 2026'), so the claim that none existed is superseded by later reporting. Outcome of the Aug. 6 deadline could not be confirmed in available sources.Proposed correction (not yet applied)On July 31, 2026, Wanchain publicly offered the attacker a white-hat settlement, demanding the return of 90% of the stolen NIGHT by August 6, 2026 in exchange for a 10% bounty and a pledge not to pursue civil litigation; the bridge remained offline. - #18[stale][awaiting moderator]in section: Wanchain's Response and Leadership
“As of late July 2026, no formal post-mortem had been published and no compensation plan for affected users had been announced.”
reviewerAs of late July 2026, no formal post-mortem had been published and no compensation plan for affected users had been announced; the bridge remained suspended.Same underlying staleness as the Incident Overview section -- a concrete compensation/recovery proposal was announced before the month was out.Proposed correction (not yet applied)By late July 2026, Wanchain had not published a formal post-mortem, but on July 31 it publicly offered the attacker a white-hat settlement -- return 90% of the stolen NIGHT by August 6, 2026 in exchange for a 10% bounty and a pledge not to pursue civil litigation.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #26[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260728210620/https://blockonomi.com/twenty-one-capital-leadership-shakeup-mallers-exits-as-merger-deal-falls-through/”
reviewerThe Blockonomi article is correctly archived at the listed wayback snapshot.The archive_url recorded for this source does not correspond to the cited article at all -- it appears to be a copy-paste or indexing error. The live blockonomi.com URL itself is valid and supports the page's claims; only the archive snapshot is wrong. Proposed correction uses the live URL as an interim placeholder pending a fresh Wayback snapshot of the correct article.Proposed correction (not yet applied)https://blockonomi.com/13m-wanchain-bridge-hack-drains-515m-night-tokens-via-signature-exploit
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #13[partially supported][awaiting moderator]in section: Midnight Foundation and Cardano Network Response
“Hoskinson stated: "Bridges are the most vulnerable of all of these attacks in the cryptocurrency space," and analogized systemic risk by noting that partial resistance to an attack vector does not guarantee immunity under sufficient exposure.”
reviewerHoskinson stated: 'Bridges are the most vulnerable of all of these attacks in the cryptocurrency space,' and analogized systemic risk to partial disease resistance.The analogy is confirmed in the cited source almost word-for-word; the preceding direct quotation attributed to Hoskinson could not be verified in the cited source or in broader search. - #14[partially supported][awaiting moderator]in section: Midnight Foundation and Cardano Network Response
“He also referenced future development of identity tools such as Midnight Passport as a basis for insurance products covering security failures.”
reviewerHoskinson referenced future development of identity tools such as Midnight Passport as a basis for insurance products covering security failures.Hoskinson has separately discussed Midnight Passport and insurance in interview/podcast contexts, so the claim is plausibly true, but neither source actually cited for this section supports it -- a citation mismatch rather than a fabrication.
confirmed
15 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On July 20–21, 2026, an attacker exploited a cryptographic signature-reuse vulnerability in the Wanchain-operated cross-chain bridge connecting Cardano and BNB Chain, draining approximately 515 million NIGHT tokens valued between $9 million and $13 million at the time of theft.”
reviewerOn July 20-21, 2026, an attacker exploited a signature-reuse vulnerability in the Wanchain-operated Cardano-BNB Chain bridge, draining ~515 million NIGHT worth $9-13M; the TreasuryCheck validator concatenated 14 fields without delimiters; Midnight/Cardano were not compromised.Core facts independently corroborated across multiple outlets; the $9-13M range is itself an accurate reflection of genuine outlet disagreement. - #2[confirmed][no action needed]in section: Incident Overview
“The exploit occurred between approximately 14:46 and 14:55 UTC on July 20, 2026, with public reporting concentrating on July 21, 2026. Attackers executed four sequential transactions over roughly eight to nine minutes, draining the bridge's Cardano-side lock address.”
reviewerThe exploit occurred 14:46-14:55 UTC on July 20, 2026, via four transactions in 8-9 minutes, draining ~515.2 million NIGHT from the bridge's Cardano-side lock address.Timing and transaction count match the technical-analysis source precisely. - #4[confirmed][no action needed]in section: Technical Vulnerability: Non-Injective Signed-Message Encoding
“The attacker exploited this by rearranging field boundaries to construct a Cardano withdrawal instruction whose encoded form was byte-identical to a previously signed, legitimate BNB Chain authorization for approximately 3,110 NIGHT. By replaying that signature, the attacker extracted 203,001,692 NIGHT in the largest single transaction—a 65,000-fold amplification of the authorized amount.”
reviewerBlockSec identified a non-injective signed-message encoding flaw: 14 variable-length fields concatenated via AppendByteString without delimiters; a signature for ~3,110 NIGHT was replayed to extract 203,001,692 NIGHT (65,000x); reserve fell ~97.8% from ~527M to ~12M NIGHT; SerialiseData existed but was unused.Highly specific technical figures are confirmed verbatim against the cited technical-analysis source. - #5[confirmed][no action needed]in section: Attacker Behavior and Fund Disposition
“An additional approximately 68.27 million NIGHT were deposited into the Liqwid lending protocol as collateral, suggesting the attacker may have been attempting to borrow other assets against the stolen tokens rather than immediately selling the entire position.”
reviewerApproximately 290-300 million NIGHT were liquidated via DEX/DeFi on Cardano; ~68.27 million NIGHT were deposited into Liqwid as collateral; Binance, Kraken, KuCoin, Bybit, OKX, Gate, and MEXC froze/restricted suspected stolen assets.Fund-disposition figures match the cited technical source closely, including the specific exchange list. - #6[confirmed][no action needed]in section: Market Impact and Price Action
“The NIGHT token fell sharply following the exploit, reaching an all-time low in the range of $0.015–$0.016 intraday on July 21, 2026, representing a decline of 28–43% depending on the reference price.”
reviewerNIGHT reached an all-time low of $0.015-0.016 intraday on July 21, 2026 (28-43% decline); this represented ~2% of the 24 billion token supply; NIGHT rebounded 19-35% within 24 hours to roughly $0.022.The wide ranges given (28-43% decline, 19-35% rebound) accurately reflect genuine, hedged disagreement across the cited outlets rather than cherry-picking. - #15[confirmed][no action needed]in section: Midnight Foundation and Cardano Network Response
“Hoskinson separately stated: "We have huge things coming for Midnight," reaffirming confidence in the project's longer-term trajectory.”
reviewerHoskinson separately stated: 'We have huge things coming for Midnight,' reaffirming confidence in the project's longer-term trajectory.Minor wording variance ('some huge things' vs 'huge things') but substantively confirmed. - #16[confirmed][no action needed]in section: Wanchain's Response and Leadership
“Wanchain took the Cardano-to-BNB Chain bridge offline immediately upon detecting the breach and stated publicly: "We are aware of an incident affecting the Cardano BNB Chain bridge," committing to "full transparency" once its investigation concluded.”
reviewerWanchain stated publicly: 'We are aware of an incident affecting the Cardano BNB Chain bridge,' committing to 'full transparency' once its investigation concluded.Quotes confirmed verbatim against the cited source. - #17[confirmed][no action needed]in section: Wanchain's Response and Leadership
“Louie, who holds a degree from the London School of Economics, was appointed CEO in February 2024, succeeding Wanchain founder Jack Lu who moved to an advisory role.”
reviewerLouie, who holds a degree from the London School of Economics, was appointed CEO in February 2024, succeeding founder Jack Lu who moved to an advisory role; Wanchain launched in 2017.Biographical details match the cited source exactly. - #19[confirmed][no action needed]in section: Broader Industry Context
“CryptoTimes reported on July 26, 2026 that the industry lost over $47 million across multiple hacks in a single week, with Wanchain, AFX Trade, and Verus among the affected entities.”
reviewerCryptoTimes reported the industry lost over $47 million across multiple hacks in a single week, with Wanchain, AFX Trade, and Verus among the affected entities.Direct headline match to the cited article. - #20[confirmed][no action needed]in section: Broader Industry Context
“A 2022 Chainalysis estimate held that approximately $2 billion had been stolen through 13 bridge hacks, representing 69% of all cryptocurrency stolen that year.”
reviewerA 2022 Chainalysis estimate held that approximately $2 billion had been stolen through 13 bridge hacks, representing 69% of all cryptocurrency stolen that year; prior incidents include Ronin ($624M, 2022) and Wormhole ($326M, 2022).Well-documented industry figure, independently verified; Ronin and Wormhole loss figures are also standard, widely corroborated amounts. - #21[confirmed][no action needed]in section: Regulatory and Legal Status
“No regulatory action by the SEC, CFTC, or other governmental body in connection with this exploit has been reported in verifiable sources reviewed for this investigation as of late July 2026.”
reviewerNo regulatory action by the SEC, CFTC, or other governmental body in connection with this exploit has been reported, and no law enforcement identification of the attacker has been publicly confirmed, as of late July 2026.A broad web search for SEC/CFTC/law-enforcement action on this incident corroborates the absence of any reported regulatory action as of the review date. - #22[confirmed][no action needed]in the timeline
“Attacker executes four transactions between approximately 14:46 and 14:55 UTC, draining approximately 515.2 million NIGHT tokens from the Wanchain Cardano-to-BNB Chain bridge treasury in roughly eight to nine minutes. The exploit is attributed to a non-injective signed-message encoding flaw in the TreasuryCheck validator.”
reviewerAttacker executes four transactions between 14:46-14:55 UTC July 20, draining ~515.2M NIGHT; attributed to non-injective encoding flaw in TreasuryCheck validator.Confirmed. - #23[confirmed][no action needed]in the timeline
“Wanchain publicly acknowledges the breach and takes the Cardano-BNB Chain bridge offline. NIGHT token falls to an all-time low near $0.015–$0.016, a decline of 28–43% intraday. BlockSec's Phalcon monitor issues preliminary analysis. Midnight Foundation confirms Midnight blockchain is unaffected.”
reviewerWanchain publicly acknowledges the breach and takes the bridge offline; NIGHT falls to an ATL near $0.015-0.016 (28-43% decline); BlockSec's Phalcon monitor issues preliminary analysis; Midnight Foundation confirms Midnight blockchain is unaffected -- on July 21, 2026.Confirmed. - #24[confirmed][no action needed]in the timeline
“NIGHT token rebounds approximately 19% from session lows. Charles Hoskinson comments publicly, calling for industry-wide shift to zero-knowledge proof-based bridge infrastructure. CoinDesk reports on the rebound and Hoskinson's statements.”
reviewerNIGHT rebounds ~19% from session lows on July 22, 2026; Hoskinson comments publicly calling for industry-wide shift to ZK-proof bridge infrastructure; CoinDesk reports on this.Confirmed. - #25[confirmed][no action needed]in the timeline
“CryptoTimes reports the industry lost over $47 million across multiple hacks in a single week, citing Wanchain, AFX Trade, and Verus as among the affected projects.”
reviewerCryptoTimes reports on July 26, 2026 the industry lost over $47 million across multiple hacks in a single week, citing Wanchain, AFX Trade, and Verus.Confirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.