Audit log

Every state-changing event for Wanchain: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-07-22 01:50:00Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   EnoCyhYMSsE1…MSMQHArHcopysha256 → base58

   verifying row…

   canonical bytes (14149 B) ▸

   {"actor":"system:backfill","investigation_id":"2becd499-3884-4049-b7ff-822cc47c58c3","kind":"publish","page_slug":"wanchain","published_at":"2026-07-22T01:49:59.887Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wanchain","sections":[{"content":"On July 21, 2026, blockchain security firm BlockSec's Phalcon monitoring system detected an exploit of Wanchain's bridge connecting Cardano to BNB Chain. According to BlockSec's analysis, an attacker drained approximately 515.2 million NIGHT tokens (the native token of the Midnight blockchain, a Cardano-affiliated privacy network) worth roughly $9-10 million at the time, with some outlets reporting the figure as high as $13 million depending on the token price used. The stolen tokens moved to a single wallet in four transactions — reported as 203.0 million, 129.6 million, 120.4 million, and 62.1 million NIGHT — arriving between 14:46 and 14:55 UTC, an eight-minute window. The attacker then allegedly liquidated roughly 90% of the proceeds, funneling approximately 300 million NIGHT through Cardano DEX swaps (generating roughly 24.02 million ADA and 1.44 million USDCx according to on-chain tracing) while depositing a further tranche (reported around 68.27 million NIGHT) into the Liqwid lending protocol on Cardano as collateral, according to on-chain analysis cited by crypto.news. This is characterized as an alleged root cause and mechanism pending Wanchain's own technical post-mortem, which had not been published as of the exploit date.","heading":"July 2026 Cardano Bridge Exploit — $10M NIGHT Token Theft","severity":"critical","sources":[{"credibility":2,"name":"Wanchain Cardano Bridge Exploited, Hackers Stole $10M in NIGHT Tokens - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/21/wanchain-cardano-bridge-exploited-hackers-stole-10m-in-night-tokens/"},{"credibility":2,"name":"Wanchain Cardano bridge exploit drains 515M NIGHT worth $9M - crypto.news","type":"news_article","url":"https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/"},{"credibility":2,"name":"Breaking: Wanchain Cardano Bridge Breached in $13M Hack, 515M NIGHT Tokens Drained - CoinGape","type":"news_article","url":"https://coingape.com/wanchain-cardano-bridge-breached-in-13m-hack-515m-night-tokens-drained/"}]},{"content":"According to BlockSec and reporting derived from its analysis, the vulnerability originated in Wanchain's TreasuryCheck validator, a Cardano smart contract governing bridge payouts. The contract allegedly constructed its signed message by raw-concatenating 14 variable-length redeemer fields with no delimiters or length markers between them — a design described as 'non-injective signed-message encoding.' Because the fields lacked boundaries, different combinations of field values could collapse to the identical byte string and therefore the identical hash and signature, a classic signature-malleability/reuse defect. BlockSec stated the same signature was allegedly reused on Cardano to extract 203,001,692 NIGHT in a single transaction — described as roughly a 65,000x inflation of an authorized payout amount relative to what should have been approved. BlockSec further noted the contract already had access to Cardano's SerialiseData function, which would have prevented field-boundary ambiguity, but the validator did not use it when building the signature hash. These technical claims originate from BlockSec's public incident analysis as relayed by crypto-news outlets; Wanchain had not published its own detailed post-mortem as of the reporting date, so the precise technical root cause should be treated as alleged pending an official confirmation.","heading":"Technical Root Cause — Signature Reuse via Non-Injective Encoding","severity":"critical","sources":[{"credibility":2,"name":"Wanchain Cardano Bridge Exploited, Hackers Stole $10M in NIGHT Tokens - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/21/wanchain-cardano-bridge-exploited-hackers-stole-10m-in-night-tokens/"},{"credibility":2,"name":"Wanchain Cardano bridge exploit drains 515M NIGHT worth $9M - crypto.news","type":"news_article","url":"https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/"}]},{"content":"Following the exploit, the NIGHT token fell sharply. Multiple outlets reported a 30-40% intraday decline, with one report specifying a 35.12% drop over 24 hours to $0.0174, after the token had earlier climbed to $0.02689, and a low near $0.01582 recorded as a new all-time low. Trading volume reportedly surged roughly 798% to $125.96 million as the news broke and holders sold. Because NIGHT is the token of the Midnight network — a privacy-focused blockchain with formal ties to the Cardano ecosystem, backed in part by the Cardano Foundation and Input Output Global — the crash drew scrutiny to the relationship between third-party bridge infrastructure and token price stability for assets that rely on bridges for cross-chain liquidity.","heading":"Market Impact and NIGHT Token Crash","severity":"high","sources":[{"credibility":2,"name":"Cardano: Midnight Crashes 35% After 515M NIGHT Exploit Rocks Wanchain Bridge - The Crypto Basic","type":"news_article","url":"https://thecryptobasic.com/2026/07/21/cardano-midnight-crashes-35-after-515m-night-exploit-rocks-wanchain-bridge/"},{"credibility":2,"name":"Wanchain Bridge Exploit Drains 515M NIGHT As Token Crashes - TronWeekly","type":"news_article","url":"https://www.tronweekly.com/wanchain-bridge-exploit-drains-515m-night-as/"}]},{"content":"Wanchain took its interoperability bridge offline once the exploit was detected. In a public statement, the Wanchain team said: 'The Wanchain Bridge is currently unavailable to users. Please know that this has our full attention. We are committed to full transparency.' Separately, the Midnight Foundation moved to isolate reputational and technical blame to Wanchain's bridge infrastructure, stating the incident 'does not reflect any vulnerability in the underlying Midnight blockchain' and that 'Midnight's protocol, validator network, consensus mechanism, and core infrastructure continue to function normally and remain secure.' As of the reporting date, neither Wanchain nor Midnight had announced a compensation plan for affected users, a bridge-resumption timeline, or a completed technical post-mortem. Wanchain also posted publicly (via its official X/Twitter account) a general statement about bridge security standards in the industry, though this predates and does not directly address the specific incident's remediation status.","heading":"Official Response — Bridge Suspension and Blame Isolation","severity":"high","sources":[{"credibility":2,"name":"Wanchain Cardano Bridge Exploited, Hackers Stole $10M in NIGHT Tokens - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/21/wanchain-cardano-bridge-exploited-hackers-stole-10m-in-night-tokens/"},{"credibility":2,"name":"Wanchain Cardano bridge exploit drains 515M NIGHT worth $9M - crypto.news","type":"news_article","url":"https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/"},{"credibility":2,"name":"Cardano: Midnight Crashes 35% After 515M NIGHT Exploit Rocks Wanchain Bridge - The Crypto Basic","type":"news_article","url":"https://thecryptobasic.com/2026/07/21/cardano-midnight-crashes-35-after-515m-night-exploit-rocks-wanchain-bridge/"}]},{"content":"Wanchain is a blockchain interoperability project founded by Jack Lu, who previously co-founded Factom as CTO and worked as a software architect at Xerox and Hewlett-Packard. Lu released the Wanchain whitepaper in October 2017 and ran an ICO the same month that reportedly raised approximately $36 million, selling out within a day. Wanchain's WAN token was initially issued as an ERC-20 token before migrating to Wanchain's own mainnet. The project has operated for close to a decade with the stated goal of enabling cross-chain asset transfers and communication between networks including Ethereum, Bitcoin, BNB Chain, and, as of December 2025, Cardano (via the bridge later exploited in this incident). Leadership has since transitioned: Jack Lu moved to an advisory role, with Temujin Louie assuming the CEO position. No independent, reliable reporting was found substantiating claims of prior large-scale hacks of Wanchain-operated bridges before the July 2026 incident, nor was any SEC or other regulatory enforcement action against Wanchain identified in available reporting.","heading":"Background — Project History and Founding Team","severity":"low","sources":[{"credibility":2,"name":"Jack Lu - Founder & CEO at Wanchain - CryptoSlate","type":"other","url":"https://cryptoslate.com/people/jack-lu/"},{"credibility":3,"name":"Wanchain's AMA Recap: Jack Lu Transitions CEO Role to Temujin Louie - Medium","type":"other","url":"https://medium.com/@InsaneChemical/wanchain-s-ama-recap-jack-lu-transitions-ceo-role-to-temujin-louie-07bf9bd5ae75"}]},{"content":"Cross-chain bridges have been a persistently high-risk category within crypto infrastructure. Industry data compiled by blockchain analytics firms indicates roughly $2 billion was stolen across 13 major cross-chain bridge hacks in 2022 alone, including the $600 million Ronin Bridge exploit. The July 2026 Wanchain incident fits this established pattern: a custodial or semi-custodial bridge holding pooled treasury funds, secured by validator signatures, proved vulnerable to a smart-contract-level encoding flaw rather than a private-key compromise. This context is included for background and does not itself constitute a claim against Wanchain specifically.","heading":"Broader Industry Context — Cross-Chain Bridge Risk","severity":"medium","sources":[{"credibility":2,"name":"Cross-Chain Bridge Hacks Emerge as Top Security Risk - Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/cross-chain-bridge-hacks-2022/"}]}],"sources_used":[{"credibility":2,"name":"Wanchain Cardano Bridge Exploited, Hackers Stole $10M in NIGHT Tokens - CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/21/wanchain-cardano-bridge-exploited-hackers-stole-10m-in-night-tokens/"},{"credibility":2,"name":"Wanchain Cardano bridge exploit drains 515M NIGHT worth $9M - crypto.news","type":"news_article","url":"https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/"},{"credibility":2,"name":"Breaking: Wanchain Cardano Bridge Breached in $13M Hack, 515M NIGHT Tokens Drained - CoinGape","type":"news_article","url":"https://coingape.com/wanchain-cardano-bridge-breached-in-13m-hack-515m-night-tokens-drained/"},{"credibility":2,"name":"Cardano: Midnight Crashes 35% After 515M NIGHT Exploit Rocks Wanchain Bridge - The Crypto Basic","type":"news_article","url":"https://thecryptobasic.com/2026/07/21/cardano-midnight-crashes-35-after-515m-night-exploit-rocks-wanchain-bridge/"},{"credibility":2,"name":"Wanchain Bridge Exploit Drains 515M NIGHT As Token Crashes - TronWeekly","type":"news_article","url":"https://www.tronweekly.com/wanchain-bridge-exploit-drains-515m-night-as/"},{"credibility":2,"name":"Wanchain's Cardano Bridge Hacked: 515M NIGHT Tokens Stolen - Phemex News","type":"news_article","url":"https://phemex.com/news/article/wanchains-cardano-bridge-hacked-515-million-night-tokens-stolen-93993"},{"credibility":2,"name":"Cross-Chain Bridge Hacks Emerge as Top Security Risk - Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/cross-chain-bridge-hacks-2022/"},{"credibility":2,"name":"Jack Lu - Founder & CEO at Wanchain - CryptoSlate","type":"other","url":"https://cryptoslate.com/people/jack-lu/"},{"credibility":2,"name":"What Is Wanchain? Introduction To WAN Token - CryptoBriefing","type":"other","url":"https://cryptobriefing.com/what-is-wanchain-introduction-to-wan-token/"}],"summary":"Wanchain is a blockchain interoperability project founded in 2017 by Jack Lu that operates cross-chain bridges connecting networks such as Ethereum, BNB Chain, and Cardano. On July 21, 2026, Wanchain's Cardano-to-BNB Chain bridge was exploited for approximately $10 million (515.2 million NIGHT tokens) due to a signature-reuse flaw in its TreasuryCheck validator, one of the larger cross-chain bridge exploits of 2026. The incident caused a 30-40% intraday crash in the price of NIGHT (the token of the Cardano-affiliated Midnight blockchain) and prompted Wanchain to take its bridge offline while the Midnight Foundation publicly distanced its core network from the breach.","timeline":[{"date":"2017-10-01","event":"Wanchain whitepaper released by founder Jack Lu; ICO reportedly raises approximately $36 million.","source":"CryptoBriefing / project background reporting","source_url":"https://cryptobriefing.com/what-is-wanchain-introduction-to-wan-token/"},{"date":"2025-12-01","event":"Wanchain launches cross-chain bridge support connecting Cardano's NIGHT token to BNB Chain.","source":"crypto.news","source_url":"https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/"},{"date":"2026-03-01","event":"Midnight blockchain mainnet launches.","source":"crypto.news","source_url":"https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/"},{"date":"2026-07-20","event":"Attacker allegedly exploits signature-reuse flaw in Wanchain's TreasuryCheck validator; 515.2 million NIGHT tokens moved to attacker wallet across four transactions between 14:46-14:55 UTC.","source":"The Crypto Basic / BlockSec analysis","source_url":"https://thecryptobasic.com/2026/07/21/cardano-midnight-crashes-35-after-515m-night-exploit-rocks-wanchain-bridge/"},{"date":"2026-07-21","event":"BlockSec's Phalcon monitor publicly flags the exploit; Wanchain takes its bridge offline; Midnight Foundation issues statement isolating the incident to bridge infrastructure; NIGHT token price falls 30-40% intraday to a new all-time low.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/21/wanchain-cardano-bridge-exploited-hackers-stole-10m-in-night-tokens/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 167120ef-2ba6-4359-9607-2f43a4c69393copy