Wanchain's Cardano Bridge Forgets Its Own Signature, $13M Walks Out 🖋️

Attackers drained approximately 515 million $NIGHT tokens, valued at roughly $13 million, from the Wanchain-operated bridge connecting Cardano and BNB Chain on July 21, 2026, sending $NIGHT down more than 30% to a record low near $0.016. Wanchain has taken the bridge offline and is investigating, while the Midnight Foundation confirmed that the breach was confined to third-party bridge infrastructure and that the Midnight network, its validators and its consensus layer remain fully secure.

Blockchain security firm BlockSec Phalcon traced the exploit to a signature reuse vulnerability that allowed attackers to turn a ~3,110 $NIGHT signature into more than 203 million $NIGHT, a roughly 65,000x inflation effect within a single transaction. The mechanism let the attacker repeatedly replay a small valid signature to mint oversized cross-chain transfers, draining the bridge treasury in one coordinated move.

The incident marks the first major exploit in the Wanchain bridge's eight-plus years of operation across dozens of blockchains. The Cardano integration, announced alongside the Midnight token launch by Cardano founder Charles Hoskinson, was positioned as a step to deepen the Cardano ecosystem's cross-chain capabilities and to support asset interoperability, including RLUSD on Cardano.

The Midnight Foundation stated that Midnight's protocol, native token and validator set were unaffected and that user funds outside the bridge remain safe. Wanchain said it is working with external auditors and law enforcement contacts, and has paused all bridge contracts while forensic analysis continues, with no timeline yet provided for restoring cross-chain $NIGHT transfers.