Charles Hoskinson Outlines Cardano Bridge Security Model Using Midnight ZK Proofs

Charles Hoskinson has proposed a new security model for Cardano bridges following the Wanchain exploit involving Cardano and BNB Chain. In his whiteboard video, “Getting Bridges back on Track,” he described how Midnight ZK proofs, layered authorization and automated circuit breakers could reduce the risk of future bridge attacks.

Wanchain Exploit Exposed Four Bridge Attack Surfaces

The previously reported Wanchain bridge incident involved approximately 515 million $NIGHT tokens leaving the Cardano side of the bridge treasury before much of the liquidity reached Cardano decentralized exchanges. Midnight’s protocol, validator network and Cardano native asset were not compromised.

Hoskinson also addressed calls to restore the cNIGHT supply to its previous state. He said the tokens had already been distributed as Cardano native assets, leaving Midnight and Input Output without a centralized mechanism to reverse ownership of tokens held in user wallets.

Under the model described in the video, users lock the Cardano representation of $NIGHT before receiving a corresponding wrapped asset on BNB Chain. Returning the asset requires the wrapped tokens to be destroyed before the original tokens can be unlocked on Cardano.

Hoskinson identified four separate attack surfaces in that process: the Plutus contract on Cardano, the Solidity contract on BNB Chain, the off-chain Cardano infrastructure and the off-chain BNB Chain infrastructure. A failure in any component can result in false confirmations, invalid authorization or unauthorized token releases.

He added that bridges can verify more than asset transfers. They may also prove transaction status, UTxO membership, minting and burning events, delegation, rewards, script outcomes and governance actions. His presentation listed 42 categories of possible Cardano state claims and 52 for Midnight.

Midnight ZK Model Would Remove the Bridge Operator

Hoskinson’s proposed model replaces the conventional bridge operator with a zero-knowledge proof generated by the user and linked to a destination address on another blockchain. The proof would be submitted to a verifier contract that checks whether the required event occurred on the source chain.

Any party could relay the proof because authorization would depend on its cryptographic validity rather than the identity of the messenger. Once verified, the destination contract could mint or release the corresponding asset without relying on a bridge operator to interpret both blockchains.

Midnight is a privacy-focused Cardano partner chain that supports applications combining public and private state, zero-knowledge proofs and selective disclosure. Its Compact language is designed to let TypeScript developers build ZK-enabled applications without implementing the underlying cryptography directly.

Hoskinson proposed combining ZK verification with a threshold signature system. A transaction would proceed only when both mechanisms approved it. A failure in either layer could stop the bridge from operating, while the second layer would continue protecting the locked assets from unauthorized release.

The technical foundation includes the research paper “Crossing with Confidence: Formal Analysis and Model Checking of Blockchain Bridges,” which defines and tests security properties across several bridge architectures. Hoskinson did not announce a development team, release date or completed Cardano and Midnight ZK bridge.

Cardano Pub/Sub and Midnight Passport Extend the Security Model

Hoskinson also described a Cardano-wide alert system for containing attacks after they are detected. Decentralized exchanges, lending protocols, wallets, centralized exchanges and bridge operators could subscribe to verified security channels through a publish-subscribe network.

An alert from a compromised bridge could trigger automated circuit breakers, allowing connected applications to suspend trading, withdraw liquidity, disable lending markets or halt transfers. The objective is to restrict an attacker’s ability to exchange stolen assets for stablecoins or move them through laundering services.

Hoskinson placed the Pub/Sub infrastructure among Cardano’s priorities for 2027, following further progress on Ouroboros Leios. Input Output previously published an experimental Cardano Pub/Sub prototype, which was archived on July 17 with a notice that development had moved to a new repository.

The final part of the proposal covers optional white-hat wallet protection. Users could authorize a predefined intervention when creating a non-custodial wallet. During an active attack, an approved white-hat party could move exposed assets, after which the owner would privately prove the right to recover them.

Hoskinson connected that process to Midnight Passport and selective disclosure. Midnight documentation describes Passport as an announced seedless consumer wallet with hardware-resident keys and trusted-helper recovery. In the proposed model, it could also privately connect a wallet to its owner, a white-hat authorization and an insurance policy.

The formal bridge research and experimental Pub/Sub work are already public. The ZK bridge, production circuit breakers, white-hat licensing system and Passport-based insurance model remain proposed components without published implementation schedules.