Wanchain Bridge Incident Sends 515 Million NIGHT to Cardano DEXs

Approximately 515 million $NIGHT tokens left Wanchain’s Cardano-side bridge treasury on July 20 before substantial volumes reached Cardano decentralized exchanges. The resulting sales created immediate pressure across Cardano DeFi, while the technical investigation remains focused on Wanchain’s cross-chain infrastructure.

515 Million NIGHT Leaves Wanchain Bridge Treasury

Charles Hoskinson said an automated monitoring system detected unusual market activity after NIGHT began falling rapidly. The initial investigation traced the activity to Wanchain’s bridge between Cardano and BNB Chain.

Hoskinson initially estimated that approximately half a billion NIGHT had been transferred and that most of the tokens were sold soon afterward on Cardano DEXs.

Blockchain security platform BlockSec Phalcon subsequently reported that approximately 515 million NIGHT had left the bridge treasury on Cardano. BlockSec described its findings as preliminary and did not provide a final calculation of the amount sold, proceeds received or total financial loss.

The rapid arrival of such a large token supply forced Cardano liquidity pools to absorb the sales within a short period. The trades occurred through Cardano DeFi, but the reported transaction path originated from infrastructure used to validate cross-chain transfers.

WanBridge is Wanchain’s non-custodial bridge for moving fungible tokens and NFTs between EVM and non-EVM networks. Its infrastructure coordinates the locking, minting, burning and unlocking of assets across separate blockchains.

For NIGHT, the affected route connects Cardano and BNB Chain. A failure in the validation process could authorize an incorrect release of tokens or create a mismatch between the assets held by the bridge and the supply available on the destination network.

Wanchain has not yet published reserve accounting that would confirm whether such a mismatch occurred in this incident.

Midnight Says Its Core Network Was Not Affected

Midnight is a privacy-focused Cardano partner chain designed for applications that require protected data, selective disclosure and programmable compliance.

$NIGHT is Midnight’s public native token and forms part of the network’s governance and economic model. Holding NIGHT generates DUST, a shielded resource used for transactions and smart contract execution on Midnight.

In its initial incident statement, Midnight Foundation confirmed that it was investigating activity involving Wanchain’s Cardano to BNB Chain bridge and bridged NIGHT.

The Foundation later clarified that the incident was isolated to third-party bridge infrastructure. It said Midnight’s protocol, validator network, consensus system and core infrastructure continued to operate normally.

Hoskinson also said the Cardano token contract remained operational and that the Glacier Drop distribution process was not interrupted.

The security boundary and the market impact therefore sit in different parts of the ecosystem. The reported vulnerability concerns Wanchain’s validation infrastructure, while the economic effect appeared on Cardano because the transferred tokens were sold through its decentralized exchanges.

Hoskinson identified four components for examination: the Cardano-side contract, the BNB Chain contract and the off-chain infrastructure connected to each network. A coordinated response group involving Midnight Foundation, Shielded Technologies, Cardano ecosystem participants and the Intersect Security Council began reviewing the token flows and affected bridge components.

BlockSec Flags Possible Signature Encoding Flaw

BlockSec’s preliminary analysis points to a possible weakness in Wanchain’s TreasuryCheck validator, which verifies signed instructions before bridge assets can be released.

According to the security firm, the validator combines 14 data fields of different lengths without consistently recording their boundaries. Under specific conditions, different combinations of field values could produce the same final byte sequence used for signing.

That structure could allow a valid signature created for one transaction to be reused with a different set of transaction parameters. BlockSec reached the preliminary assessment after reviewing the Plutus V2 validator code and a transaction connected to the incident.

Wanchain has not confirmed that this encoding issue was the definitive cause. A complete postmortem would need to identify the initial transaction, demonstrate how authorization was bypassed and determine whether any additional bridge components were compromised.

Several operational details also remain undisclosed, including the amount of NIGHT sold on individual Cardano DEXs, the current balance of bridge reserves, whether user-backed assets were affected and the status of the Cardano to BNB Chain route.

Wanchain’s technical report will need to reconcile the reported 515 million NIGHT movement against bridge liabilities, document the validator correction and define the conditions for restoring cross-chain transfers. Those disclosures will establish the reserve shortfall, if any, and determine how the bridge handles affected assets.