About 515 million NIGHT tokens, valued at approximately $9 million, were drained from Wanchain's Cardano-to-BNB Chain bridge treasury in a recent exploit, blockchain security firm BlockSec reported.
The Midnight Foundation confirmed the incident affected only the bridge infrastructure, leaving the core Midnight network secure. Despite this, the NIGHT token dropped over 30% as the exploit triggered heavy selling pressure within 24 hours.
BlockSec's initial analysis suggests a vulnerability in the TreasuryCheck validator, which creates signed messages by combining 14 fields without clear separators or length indicators. This flaw may enable signature reuse attacks, where rearranged data can generate the same signed message, potentially authorizing unauthorized transactions.
The security firm examined onchain Plutus V2 code and linked transactions to reach these conclusions but emphasized that the investigation is ongoing and preliminary. Wanchain has not yet released a full technical postmortem. BlockSec noted the contract included Cardano's SerialiseData function but it was not employed for signature hashing, which might have prevented the ambiguity.
Wanchain launched the cross-chain support for NIGHT tokens between Cardano and BNB Chain in December 2025, enabling token transfers via its bridge infrastructure.
This material is for informational purposes and does not constitute financial advice.
