Wanchain Bridge Exploit Drains Hundreds of Millions of NIGHT Tokens, Sending Midnight Token to All-Time Low

On July 21, 2026, an attacker exploited a signed-message encoding flaw in Wanchain's Cardano-BNB bridge, draining 515 million NIGHT tokens worth up to $10 million. The attacker dumped 290 million tokens on decentralized exchanges, crashing the NIGHT price by over 30% to an all-time low before a partial 19% recovery. Wanchain disabled the bridge, and seven major exchanges froze the remaining stolen funds. The Midnight Foundation confirmed its core Layer-1 network remains secure and unaffected.

Wanchain bridge exploit

• ▪The attacker drained approximately 97% of the NIGHT reserves from Wanchain's Cardano-side lock address, leaving wrapped NIGHT on BNB Chain temporarily unbacked
• ▪The exploit occurred in four rapid transactions over an eight-minute window between 14:46 and 14:55 UTC
• ▪Wanchain's cross-chain bridge connecting Cardano to BNB Chain was exploited on July 21, 2026, resulting in the theft of approximately 515 million NIGHT tokens

Signed-message encoding vulnerability

• ▪The exploit was caused by a non-injective signed-message encoding flaw in the TreasuryCheck validator contract
• ▪The TreasuryCheck validator verified 14 variable-length redeemer fields raw-concatenated consecutively without delimiter characters or length prefixes
• ▪The attacker reused a legitimate BNB Chain signature intended for a transfer of 3,110 NIGHT to extract 203,001,692 NIGHT on the Cardano side

NIGHT token market impact

• ▪The NIGHT token price plunged by 30% to 43% following the exploit, reaching an all-time low of approximately $0.01524 to $0.016
• ▪The attacker liquidated approximately 290 million stolen NIGHT tokens on Cardano decentralized exchanges, causing the short-term price collapse
• ▪The NIGHT token price rebounded by nearly 19% within 24 hours of the crash, trading around $0.022 on July 22, 2026

Wanchain response statement

• ▪The Wanchain team suspended and completely disabled the bridge while it investigates the breach and patches the architectural vulnerability
• ▪Binance, OKX, Kraken, KuCoin, Bybit, Gate, and MEXC introduced emergency measures to freeze associated accounts and block the movement of 515 million NIGHT tokens

Midnight protocol clarification

• ▪The Midnight Foundation and Midnight Network clarified that the core Midnight protocol, validator network, consensus, and Layer-1 infrastructure remain secure and unaffected
• ▪Charles Hoskinson stated that zero-knowledge systems like Midnight are designed to eliminate trust dependencies by replacing bridge operators and multisigs with cryptographic proofs

Cross-chain bridge security history

• ▪The Wanchain bridge exploit occurred shortly after Allbridge Core lost $1.65 million in a separate infrastructure attack
• ▪Cross-chain bridge exploits, including the Ronin, Wormhole, and Nomad attacks, have collectively cost the cryptocurrency industry billions of dollars