Wanchain Cardano-BNB bridge exploit: $9M stolen

Wanchain's Cardano-BNB bridge was exploited, draining 515M NIGHT tokens ($9M). The attack exploited a signature flaw, causing a sharp price drop and bridge shutdown.

Wanchain's Cardano-BNB Chain bridge suffered a major exploit on July 21, 2026, leading to the unauthorized withdrawal of approximately 515 million NIGHT tokens from the bridge's treasury. The stolen tokens, valued at around $9 million, were used as collateral for cross-chain operations between Cardano and BNB Chain. As a result, NIGHT's price plunged over 30% within 24 hours. BlockSec's preliminary investigation identified a cryptographic vulnerability in the TreasuryCheck validator. The issue stemmed from constructing signed messages by concatenating 14 variable-length fields without clear separators or length prefixes. This allowed attackers to reuse valid signatures from legitimate transactions to authorize fraudulent withdrawals. Wanchain has since disabled the affected bridge and launched a full investigation. The breach was confirmed to be limited to the bridge infrastructure, with no impact on the Midnight or Cardano core networks. The incident highlights the critical need for robust encoding practices in cross-chain bridge security.