Breaches and incidentsBriefConfirmed by two or more outlets
Wanchain Cardano-BNB Chain bridge: ambiguous signed-message encoding allowed signature reuse
Between 14:46 and 14:55 UTC 20 Jul 2026 (detected 21 Jul): about 515M NIGHT tokens drained from the bridge treasury, valued at about USD 9M to 13M.
- Disclosed
What happened
- Root cause per BlockSec Phalcon: a “non-injective signed-message encoding” in the TreasuryCheck validator. Fourteen variable-length fields were concatenated without delimiters or length prefixes, so a signature for about 3,110 NIGHT was reused to extract over 203M NIGHT in one transaction.
- Attribution: none.
- Response: bridge taken offline. Wanchain offered the attacker 10% to return 90% by 6 Aug 2026. Outcome not found. Midnight Foundation said its network was unaffected.
Sources
- https://coingape.com/wanchain-cardano-bridge-breached-in-13m-hack-515m-night-tokens-drained/
- https://www.kucoin.com/news/flash/wanchain-offers-white-hat-settlement-for-cardano-bridge-hack
- https://ambcrypto.com/digging-deep-into-wanchains-cardano-bnb-bridge-exploit-how-9m-night-vanished-in-hours/amp/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.