Cardano News Today: Wanchain Bridge Hack Drains 515 Million NIGHT Tokens as Recovery Efforts Begin

Cross-chain bridge security is once again under the spotlight after a major exploit targeted infrastructure connecting the Cardano ecosystem with BNB Chain. The incident resulted in the theft of approximately 515.2 million NIGHT tokens, with losses estimated between $9 million and $13 million, making it one of the most significant bridge attacks affecting the Cardano ecosystem in 2026.

Source: Official Notice

The exploit did not compromise Cardano itself or the Midnight blockchain. Instead, investigators say attackers exploited a vulnerability in Wanchain's cross-chain bridge, allowing them to repeatedly authorize fraudulent withdrawals within minutes.

The attack has prompted emergency measures from Wanchain, while the Midnight Foundation has assured users that its core network remains secure. As forensic investigations continue, traders and investors are closely monitoring the recovery plan, potential compensation for affected users, and the broader implications for cross-chain infrastructure security.

Wanchain Bridge Suffers Multi-Million-Dollar Exploit

The attack occurred between July 20 and July 21, 2026, when an unknown attacker exploited a weakness in Wanchain's Cardano-to-BNB Chain bridge.

According to preliminary investigations, the attacker successfully drained approximately 515.2 million bridged NIGHT tokens from the bridge treasury in a series of rapid transactions completed in roughly eight minutes.

Blockchain records show multiple unauthorized withdrawals executed in quick succession before security teams detected the unusual activity.

One of the largest transactions transferred approximately 203 million NIGHT tokens, which were later swapped for roughly 2.8 million ADA through decentralized trading platforms operating within the Cardano ecosystem.

Once suspicious activity was identified, Wanchain immediately suspended its interoperability services to prevent additional unauthorized withdrawals.

What Is Wanchain?

Wanchain operates cross-chain infrastructure that enables digital assets to move between independent blockchain networks.

Its Cardano bridge allows users to transfer assets between Cardano and BNB Chain, supporting bridged versions of several cryptocurrencies, including NIGHT, the native token of the Midnight ecosystem.

Cross-chain bridges play an increasingly important role within decentralized finance by allowing liquidity to flow across multiple blockchain ecosystems.

However, because they manage large pools of locked assets while interacting with multiple smart contracts, bridges have also become one of the cryptocurrency industry's most frequent targets for cyberattacks.

How the Vulnerability Was Exploited

Blockchain security researchers later identified the technical flaw that enabled the attack.

According to security analysis published by BlockSec Phalcon, the vulnerability existed inside Wanchain's TreasuryCheck validator, a smart contract built using Plutus V2, Cardano's smart contract framework.

The validator generated signed messages by combining 14 separate variable-length data fields into a single string.

The critical issue was that these fields were joined together without any separators or length indicators.

Because of this design, different combinations of data could produce identical encoded messages.

Once two different withdrawal requests generated the same message hash, an attacker could reuse an existing valid signature to authorize fraudulent transactions.

In other words, previously approved signatures became reusable for entirely different withdrawal requests.

The result allowed repeated unauthorized transfers from the bridge treasury.

A Missing Security Safeguard

Interestingly, investigators noted that the smart contract already contained a safer serialization function.

The contract included Cardano's built-in SerialiseData capability, which is specifically designed to prevent this type of ambiguity by encoding structured data correctly.

However, that function was only used during output verification.

It was not applied when constructing the message used for signature verification.

As a result, the serialization protection never secured the most critical part of the withdrawal process.

Security researchers believe proper use of structured serialization would likely have prevented the exploit entirely.

NIGHT Token Price Falls After the Attack

News of the exploit triggered an immediate market reaction.

Selling pressure increased rapidly as traders attempted to assess the potential impact of the stolen assets entering circulation.

During the initial hours following the exploit, NIGHT experienced one of its largest daily declines since launch.

The token briefly dropped to an all-time low near $0.01582 before recovering part of its losses.

Source: CoinMarketCap Official

Recent market data shows:

Current Price: Approximately $0.0195
Initial Decline: Nearly 38.5%
Current Daily Loss: Approximately 25%

Trading activity also surged as investors reacted to developments surrounding the investigation.

Cardano Ecosystem Responds Quickly

The exploit prompted rapid action from projects operating within the Cardano ecosystem.

Several decentralized exchanges, including Minswap, temporarily suspended trading involving bridged NIGHT assets as a precautionary measure.

The goal was to reduce additional market disruption while investigators evaluated whether stolen assets continued moving across decentralized markets.

Meanwhile, the Midnight Foundation emphasized that its own blockchain infrastructure remained fully operational.

In an official statement, the organization clarified that:

Midnight's validator network was never compromised.
The exploit was limited to Wanchain's third-party bridge.
Core Midnight infrastructure continued operating normally.
Teams remain in active communication with Wanchain regarding the investigation.

The announcement sought to reassure users that the incident affected only bridged assets rather than the Midnight blockchain itself.

Who Is Affected?

Current information indicates that not every participant within the ecosystem faces equal risk.

The most directly affected users include:

Holders of bridged NIGHT tokens on BNB Chain.
Liquidity providers supplying assets to the Wanchain bridge.
Participants using cross-chain transfer services involving NIGHT.

Meanwhile, several groups remain unaffected:

Native Midnight blockchain users.
Midnight validators.
Users staking assets directly on the Midnight network.
Cardano's core blockchain infrastructure.

Cardano itself continued operating normally throughout the incident.

Bridge Operations Remain Suspended

Following the exploit, Wanchain suspended bridge functionality while forensic investigations continue.

At the time of writing, deposits and withdrawals through the affected bridge remain unavailable.

The temporary shutdown allows developers to:

Analyze attack transactions.
Review smart contract logic.
Identify additional vulnerabilities.
Prevent further unauthorized withdrawals.
Prepare security upgrades before reopening.

The company has not yet announced a definitive reopening date.

Recovery Plans Under Discussion

Although no official compensation plan has been finalized, several possible recovery strategies remain under consideration.

Historically, bridge operators facing similar incidents have explored options including:

Treasury replenishment using reserve funds.
Community compensation programs.
Negotiations with attackers.
Insurance-backed reimbursements where available.
Governance proposals supporting affected users.

Whether any combination of these approaches will be adopted remains unclear.

Affected users are currently awaiting further announcements from Wanchain.

Why Bridge Security Remains a Major Industry Challenge

Bridge exploits have repeatedly ranked among the largest losses within decentralized finance.

Unlike single-chain applications, cross-chain bridges must coordinate assets, signatures, validators, and smart contracts across multiple independent blockchain ecosystems.

Each additional component increases the potential attack surface.

Security experts have consistently warned that bridge infrastructure deserves the same level of auditing and testing as the underlying blockchains themselves.

The Wanchain incident reinforces that warning.

Even when base-layer networks like Cardano remain fully secure, vulnerabilities within third-party infrastructure can still expose users to significant financial risk.

What Users Should Do Now

Until investigations conclude, users should remain cautious.

Recommended steps include:

Monitor official Wanchain announcements.
Follow updates from the Midnight Foundation.
Avoid interacting with unofficial recovery websites.
Verify information through trusted community channels.
Refrain from making assumptions about compensation until formal plans are announced.

Patience will likely be necessary as investigators continue tracing transactions and evaluating recovery options.

What Comes Next?

The next phase of the investigation will likely focus on several key developments.

Market participants will be watching for:

Publication of a complete technical postmortem.
Release of updated TreasuryCheck validator code.
Confirmation of recovered or frozen assets.
Details regarding user reimbursement.
Plans for safely restoring bridge operations.

Developers across the Cardano ecosystem may also review similar smart contract implementations to determine whether comparable encoding vulnerabilities exist elsewhere.

Conclusion

The Wanchain bridge exploit represents one of the most significant cross-chain security incidents affecting the Cardano ecosystem this year. Approximately 515.2 million NIGHT tokens, valued between $9 million and $13 million, were stolen after attackers exploited a flaw in the TreasuryCheck validator's signature construction process.

Although the incident triggered sharp market volatility and forced the temporary suspension of bridge operations, the Cardano blockchain and the Midnight network remained fully secure. The exploit was isolated to Wanchain's third-party interoperability infrastructure.

As investigations continue, affected users are awaiting a formal recovery strategy while developers work to strengthen bridge security and prevent similar vulnerabilities in the future. The incident serves as another reminder that as blockchain ecosystems become increasingly interconnected, securing cross-chain infrastructure is just as important as protecting the networks themselves.

hoka.news – Not Just Crypto News. It’s Crypto Culture.