One Signature, 4 Transactions, 8 Minutes: Wanchain's Cardano Bridge Loses 515 Million NIGHT

What Happened

Wanchain's cross-chain bridge connecting Cardano to BNB Chain was exploited in an attack reported early Tuesday, July 21, draining roughly 515.2 million NIGHT tokens from the bridge's treasury contract on Cardano. NIGHT is the native token of Midnight, the privacy-focused partner chain in the Cardano ecosystem, and the haul was worth approximately $9 to $10 million at the time of the attack.

The theft did not require weeks of patient infiltration: monitoring data first flagged by security firm BlockSec's Phalcon system shows the funds moved in 4 transactions over a window of about 8 minutes. Wanchain acknowledged the incident, stating it was 'aware of an incident affecting the Cardano BNB Chain bridge' and that the bridge 'is currently unavailable to users' while it investigates.

The Midnight Foundation moved quickly to contain the blast radius, stating that the incident 'is isolated to the Wanchain Cardano-BNB bridge and does not involve the Midnight Network itself,' and that Midnight's protocol, validators, and consensus infrastructure continued operating normally.

The market punished the token anyway: NIGHT fell more than 30% within 24 hours as holders priced in 515 million units of stolen supply overhanging the order books. As of this writing, the attacker's proceeds had not been recovered, and Wanchain had not published a full post-mortem or a compensation plan.

The bridge's cryptography was flawless. Its byte string was not. Safety layers keep failing at the seams between the parts that were audited.

A Valid Signature Over an Ambiguous Message

The mechanism matters more than the dollar figure. According to BlockSec's analysis, confirmed by decompiling the on-chain Plutus V2 bytecode and decoding the redemption data in the attack transactions, the flaw sits in how the bridge's TreasuryCheck validator constructs the message its authorized signers approve.

The validator concatenates 14 redemption fields, several of them variable length, into a single byte string with no delimiters and no length prefixes. That construction is what cryptographers call non-injective: more than 1 set of field values can serialize to exactly the same bytes.

Sign the byte string for an honest withdrawal, and you have also signed every other combination of fields that happens to produce the same string.

The attacker found one. By shifting the boundaries between fields, a signature that had approved a small, legitimate redemption was replayed to authorize an enormous one: BlockSec's decoding shows a single reused signature extracting over 203 million NIGHT, an inflation of roughly 65,000 times the originally approved amount.

Nothing in the signature check failed. The elliptic curve math worked exactly as designed. The failure lived one layer down, in serialization, the unglamorous plumbing that turns structured data into bytes. BlockSec noted that encoding each field with explicit boundaries, for example hashing CBOR-serialized data instead of a raw concatenation, would have made the attack impossible.

The Treasury Check Was the Attack Surface

This is the latest entry in a pattern this series has tracked all month, and the shape is now unmistakable. Supra's signature verifier accepted a zeroed signature and a lender lost $9 million (see 'Supra's Verifier Accepted a Zeroed Signature and Bonzo Lend Lost $9 Million'). Across took its first hit in 5 years directly through its safety layer (see 'Across Went 5 Clean Years Without an Attack.

The First One Hit Its Safety Layer'). In each case, the component that existed to protect funds was the component that surrendered them. Wanchain's TreasuryCheck validator is named for its function: it is the check on the treasury. The attacker did not go around it. The attacker went through it, using its own signed approvals.

The fair counter-argument deserves stating. Wanchain had operated for more than 8 years without a major bridge incident, a long record by bridge standards, and the industry-wide data cuts both ways: Forbes reported last week that 2026's exploit losses, roughly $1.3 billion so far, reflect fewer but more surgical attacks than prior years.

Bridges are not getting sloppier; attackers are getting more precise, and the bugs that remain are exactly this kind: not broken cryptography but broken assumptions in the glue code between cryptographic components, invisible to audits that focus on the primitives. The same weekend underlined how broad the custody problem still is.

Allbridge Core lost $1.66 million to a flash loan attack on the swap logic of its Solana liquidity pools, and Zilliqa disclosed that ZIL tokens were stolen from an exchange partner's cold wallet, prompting exchanges to pause ZIL deposits. 3 different custody models, 3 different failure modes, 1 weekend.

What This Means for You

The operational lesson is about what a bridge actually is. When you bridge an asset, you are not moving it. You are depositing it with a custodian (a contract, a validator set, a multi-sig, or some combination) and receiving an IOU on the other chain. With rare exceptions, a bridged position is custodial risk that does not look like custodial risk, because there is no exchange login or account statement to remind you.

The Wanchain treasury on Cardano was, functionally, a custodian holding 515 million NIGHT for people who thought of themselves as self-custodying users.

The practical moves follow directly. Inventory your wrapped and bridged exposure this week: anything with a w or a b prefix in the ticker, plus any position that exists only on a chain the asset is not native to. Treat bridge transit like an airport layover, not a residence: bridge, complete the transaction, and return to a native asset in self-custody.

And keep the distinction sharp in your own accounting. Bitcoin held on a hardware wallet, with private keys you control, has no treasury contract, no signer set, and no serialization layer between you and your money. A wrapped claim on someone else's chain has all 3.

For anyone holding NIGHT specifically: the Midnight network itself is unaffected, but the stolen supply is real, and it overhangs the market until it is recovered, burned, or absorbed. Do not assume the repricing is finished before Wanchain publishes a post-mortem and a compensation decision.

What to Watch

Watch for Wanchain's full post-mortem and whether it commits to reimbursement from its own treasury, which will determine whether the NIGHT overhang resolves or lingers. Watch whether other bridges with Cardano-side validators audit their own message-encoding paths: the non-injective serialization bug class is generic to any validator that signs raw concatenated fields, and BlockSec's public analysis is effectively a free vulnerability scanner for every team that reads it.

And watch the exploiter's addresses: 515 million NIGHT is a hard position to exit quietly, and either the laundering path or a negotiated return will show up on-chain first.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.