A suspected exploit targeting Wanchain’s Cardano-to-BNB Chain bridge has resulted in the loss of about 515 million NIGHT tokens, triggering a sharp sell-off that pushed Midnight’s native token down more than 30% in 24 hours.
Blockchain security firm BlockSec said its preliminary investigation points to a possible flaw in the bridge’s TreasuryCheck validator. However, the firm stressed that the investigation is ongoing and that the suspected cause has not been confirmed.
Wanchain @wanchain_org Cardano bridge was reportedly being attacked, with ~515M $NIGHT drained from the bridge Treasury.
Our initial investigation suggests that the root cause seems to be a non-injective signed-message encoding in the TreasuryCheck validator. The signed message… https://t.co/bnWEnw3Dxc pic.twitter.com/PQFAN6lRn9
— BlockSec Phalcon (@Phalcon_xyz) July 21, 2026
What caused the Wanchain bridge exploit
According to BlockSec, the suspected vulnerability lies in how the TreasuryCheck validator generates messages for signing. The security firm said the validator combines multiple data fields into a single message without clearly separating or recording the length of each field.
This design could allow different sets of transaction data to produce the same signed message, creating an opportunity for a signature reuse attack. In such a scenario, an attacker could reuse a previously valid signature to authorize another transaction.
BlockSec said its findings are based on an initial review of the bridge’s on-chain Plutus V2 code and the transaction linked to the exploit. The firm added that using Cardano’s SerialiseData encoding method could have removed this ambiguity by ensuring every field is clearly defined before signing.
READ ALSO: Taiko Halts Bridge Operations After $1.7 Million Exploit
Midnight says network remains unaffected
The Midnight Foundation said the incident was isolated to Wanchain’s Cardano-to-BNB bridge and did not impact Midnight’s blockchain, validators, consensus mechanism, or other core infrastructure.
The foundation said it is working with Wanchain as the bridge operator investigates the incident.
It also noted that the exploit involved bridged assets held by the bridge rather than the creation of new NIGHT tokens. Midnight’s total token supply remains unchanged at 24 billion NIGHT.
NIGHT token crashes as bridge security risks return to focus
The exploit caused heavy selling pressure, with CoinGecko data showing NIGHT falling about 31% to around $0.0186. At that price, the stolen 515 million NIGHT tokens are worth roughly $9 million to $10 million.
The incident has renewed concerns over cross-chain bridge security. PeckShield data revealed that hackers stole $81.7 million from crypto platforms in May 2026, an 87 per cent drop from April, when losses reached $646.89 million, the highest monthly total so far this year.
Wanchain has released a detailed technical report explaining the exploit, the movement of the stolen funds, and its recovery plans, while BlockSec continues its investigation.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
