Wanchain Bridge Exploit Drains $9M in NIGHT Tokens: A Signature-Reuse Lesson

On 21 July 2026, an attacker exploited the Wanchain bridge connecting Cardano to BNB Chain, draining 515 million NIGHT tokens — the token belonging to Midnight, a privacy-focused blockchain linked to Cardano — worth roughly $9-10 million at the time of the theft. The sudden outflow briefly sent NIGHT's price down more than 30%, to a record low, before it partially recovered.

What actually broke

Security firm BlockSec identified the root cause in the bridge's TreasuryCheck validator: a message-signing scheme that built its signed payload by concatenating 14 variable-length redeemer fields with no separators and no length markers. That is a classic non-injective encoding flaw — different combinations of field values can produce the exact same byte string once concatenated, so a signature valid for one set of values can be replayed and reinterpreted to authorise a different, larger transaction.

This is not a novel vulnerability class. Ambiguous serialisation in signed messages is a well-documented pitfall in smart-contract and bridge design, and Cardano itself ships a structured serialisation primitive (SerialiseData) precisely to avoid it. The bug here was in how Wanchain's bridge logic encoded data before signing — not in Cardano, Midnight, or the NIGHT token contract.

Why the blast radius stayed contained

Midnight Foundation was quick to state that the incident was isolated to the Wanchain Cardano–BNB bridge and did not involve the Midnight Network itself — its validators, consensus mechanism, and core protocol were untouched, and the Cardano chain continued operating normally throughout. Wanchain took the bridge offline and said it was preparing a detailed update while it investigates.

That containment is the one piece of good news in an otherwise familiar story: bridges are separately-trusted, separately-audited pieces of infrastructure bolted onto chains that are themselves secure. When a bridge fails, the damage is usually scoped to the assets that passed through it — but for the users and protocols relying on that bridge's liquidity, the loss is just as real.

The pattern security teams should recognise

Bridges remain one of the highest-value targets in Web3 precisely because they concentrate custody: a single validator contract or multisig often controls assets representing the combined value locked across two chains. The specific failure mode here — ambiguous concatenation feeding a signature check — belongs to a broader family of encoding bugs that keep recurring in cross-chain and off-chain-signing designs, alongside classic issues like insufficient validator threshold checks, replay-protection gaps, and oracle manipulation.

• Signed-message construction should use length-prefixed or otherwise unambiguous (injective) encoding for every field — never raw concatenation of variable-length data.
• Bridge and validator contracts warrant the same adversarial scrutiny as the base-layer protocols they connect, since they are frequently the softer target.
• Token issuers should have a rehearsed incident-response path for a bridge-side compromise of their asset, distinct from a compromise of their own chain.

The bottom line

This was a bridge-infrastructure failure, not a Cardano or Midnight protocol failure — but from a user's perspective that distinction matters less than the fact that $9-10 million in tokens moved to an attacker's control because of one under-specified encoding decision. It is a reminder that cross-chain bridges deserve their own independent security review, separate from — and often more rigorous than — the audit given to the chains they connect.