On July 20, 2026, the Cardano-side treasury of Wanchain's Cardano-to-BNB Chain bridge lost approximately 515 million NIGHT tokens to an exploit, according to blockchain security firm BlockSec.
The NIGHT token’s price plunged nearly 30% within 24 hours after the incident was made public. BlockSec’s early investigation pointed to a vulnerability in the TreasuryCheck validator, which processes message signing.
BlockSec explained that the TreasuryCheck validator combines 14 fields of varying lengths without clear separators or individual field length records before signing. This design flaw allowed attackers to shuffle field values while maintaining a valid signature, enabling fraudulent transactions.
The security firm emphasized these findings are preliminary and based on examining the Plutus V2 source code and transaction data linked to the attack.
Wanchain confirmed the Cardano bridge was attacked, citing a "non-injective signed-message encoding" issue in the TreasuryCheck validator as the probable root cause of the drained funds.
The TreasuryCheck vulnerability seems to stem from the contract not using Cardano’s SerialiseData function for signature hashing, which would have created clear data boundaries to prevent signature reuse.
Support for cross-chain transfers of NIGHT tokens was introduced in December 2025 to facilitate asset movement via Wanchain’s infrastructure. WanBridge currently operates with threshold signature relays across both EVM and non-EVM ecosystems within the Cardano network.
The Midnight Foundation, creators of the NIGHT token, stated the exploit targeted third-party bridge infrastructure, not the Midnight blockchain or its core systems. They confirmed validators and consensus mechanisms remained operational.
BlockSec’s detailed report indicated that structured encoding could prevent such ambiguity, while Midnight Foundation continues investigating the impact on bridged NIGHT.
This article is for informational purposes only and does not constitute financial advice.
