Wanchain Bridge Exploit Drains Hundreds of Millions of NIGHT Tokens, Sending Midnight Token to All-Time Low

Jul 21, 2026

On July 21, 2026, an attacker exploited a signed-message encoding flaw in Wanchain's Cardano-BNB bridge, draining 515 million NIGHT tokens worth up to $10 million. The attacker dumped 290 million tokens on decentralized exchanges, crashing the NIGHT price by over 30% to an all-time low before a partial 19% recovery. Wanchain disabled the bridge, and seven major exchanges froze the remaining stolen funds. The Midnight Foundation confirmed its core Layer-1 network remains secure and unaffected.

Wanchain bridge exploit

▪The attacker drained approximately 97% of the NIGHT reserves from Wanchain's Cardano-side lock address, leaving wrapped NIGHT on BNB Chain temporarily unbacked.
▪The exploit occurred in four rapid transactions over an eight-minute window between 14:46 and 14:55 UTC.
▪Wanchain's cross-chain bridge connecting Cardano to BNB Chain was exploited on July 21, 2026, resulting in the theft of approximately 515 million NIGHT tokens.

Signed-message encoding vulnerability

▪The exploit was caused by a non-injective signed-message encoding flaw in the TreasuryCheck validator contract.
▪The TreasuryCheck validator verified 14 variable-length redeemer fields raw-concatenated consecutively without delimiter characters or length prefixes.
▪The attacker reused a legitimate BNB Chain signature intended for a transfer of 3,110 NIGHT to extract 203,001,692 NIGHT on the Cardano side.

NIGHT token market impact

▪The NIGHT token price plunged by 30% to 43% following the exploit, reaching an all-time low of approximately $0.01524 to $0.016.
▪The attacker liquidated approximately 290 million stolen NIGHT tokens on Cardano decentralized exchanges, causing the short-term price collapse.
▪The NIGHT token price rebounded by nearly 19% within 24 hours of the crash, trading around $0.022 on July 22, 2026.

Wanchain response statement

▪The Wanchain team suspended and completely disabled the bridge while it investigates the breach and patches the architectural vulnerability.
▪Binance, OKX, Kraken, KuCoin, Bybit, Gate, and MEXC introduced emergency measures to freeze associated accounts and block the movement of 515 million NIGHT tokens.

Midnight protocol clarification

▪The Midnight Foundation and Midnight Network clarified that the core Midnight protocol, validator network, consensus, and Layer-1 infrastructure remain secure and unaffected.
▪Charles Hoskinson stated that zero-knowledge systems like Midnight are designed to eliminate trust dependencies by replacing bridge operators and multisigs with cryptographic proofs.

Cross-chain bridge security history

▪The Wanchain bridge exploit occurred shortly after Allbridge Core lost $1.65 million in a separate infrastructure attack.
▪Cross-chain bridge exploits, including the Ronin, Wormhole, and Nomad attacks, have collectively cost the cryptocurrency industry billions of dollars.