Wanchain has suspended cross-chain operations after an exploit drained roughly 515 million NIGHT from its Cardano-to-BNB Chain bridge reserves. Security tracking tied the July 21 incident to Wanchain’s Cardano bridge infrastructure, with loss estimates ranging from about $9 million to $13 million depending on token pricing at the time of analysis.
The exploit was flagged by BlockSec’s Phalcon monitoring system, which traced the incident to a suspected signature-reuse flaw in Wanchain’s bridge verification logic. The attack reportedly unfolded through four rapid transactions over an eight-minute window.
Security notice regarding the Cardano ↔ BNB Chain Bridge. pic.twitter.com/tUrSnXg5VN
— Wanchain (@wanchain_org) July 21, 2026
Bridge Verification Became the Attack Surface
The attacker allegedly used forged cross-chain messages to mint wrapped NIGHT on BNB Chain, then triggered unauthorized withdrawals from the Cardano-side reserve. The sequence appears to have bypassed the threshold-signature checks normally used to validate bridge state changes.
That matters because Wanchain’s bridge model depends on lock, mint, burn and unlock mechanics across connected networks. Its documentation describes WanBridge as a non-custodial cross-chain transfer system where smart contracts lock, mint, burn and unlock assets across EVM and non-EVM chains.
Wanchain’s broader bridge architecture also relies on a bridge node group and threshold-signature infrastructure to secure cross-chain transfers. When that verification layer becomes the attack surface, the risk is concentrated in message validation rather than in the native token protocol itself.
The Midnight Foundation said the breach was isolated to third-party bridge infrastructure, leaving the Midnight core network, validator set and consensus mechanism unaffected. That distinction separates bridge collateral loss from a compromise of Midnight’s base-layer supply or emissions.
NIGHT Market Reacts as Forensics Continue
NIGHT sold off sharply after the bridge reserve drain became public, with reports placing the decline above 30% as liquidity adjusted across trading venues. The price reaction reflected uncertainty around the size of the exploitable reserve, downstream routing and the timeline for Wanchain’s remediation.
515.2M $NIGHT moved from Wanchain’s bridge to one Cardano wallet in 8 minutes.
Then it was sold on DEXs, used as Liqwid collateral, and the ADA was sent to a fresh vault and exchange deposit addresses.
I traced the wallet flow 🧵 pic.twitter.com/ZEHriSfunC— UTxOMaestro (@UTxOMaestro) July 20, 2026
The incident also highlights the structural risk of cross-chain collateral systems. Bridges can extend token liquidity across networks, but they also create additional trust assumptions around relayers, validators, encoded messages and reserve accounting.
Investigators are now focused on how the message sequence bypassed routing safeguards and whether any additional reserve allocations were exposed before operations were halted. Wanchain has not yet released a full technical post-mortem.
The confirmed development is a major NIGHT bridge exploit tied to Wanchain’s Cardano-BNB Chain infrastructure. The next useful indicators will be final loss reconciliation, validator-log findings, signature-remediation details, treasury recovery steps and a clear timeline for whether bridge operations resume.