Wanchain’s Cardano-$BNB Bridge, a cross-chain protocol allowing asset transfers between Cardano [$ADA] and other blockchain networks, was allegedly compromised.

This opened doors for attackers to drain up to 515 million $NIGHT tokens worth $9 million from the bridge’s treasury.

As per the investigation, the exploit was induced by a cryptographic vulnerability in the bridge’s TreasuryCheck validator called non-injective signed-message encoding.

Multiple withdrawals lead to the loss of 515 mln $NIGHT

For context, each withdrawal request in a secure system is supposed to generate a distinct message. This is to ensure that a validator’s digital signature can only authorize that particular transaction.

However, this vulnerability was possible due to multiple withdrawal requests to generate the same encrypted message.

As a result, the illicit actor was able to secure the ability to authorize phony withdrawals without having access to the validator’s private key. For its part, this was done by reusing a legitimate signature from a legitimate transaction.

Moving ahead, the wrongdoer also laundered the stolen $NIGHT tokens to $ADA on the Cardano network.

Steps taken and impact on $NIGHT

Since then, Wanchain has halted the Cardano-$BNB Bridge and begun an investigation. They even confirmed that the incident was restricted to the bridge and had no impact on Midnight’s network or Cardano’s core blockchain.

Source: Wanchain/X

Surge in exploits, but hope remains

In fact, in the past week, the crypto space has witnessed multiple exploits wherein the wrongdoer took advantage of a distinct flaw in a decentralized protocol. This included the Allbridge Core, a cross-chain bridge exploit that resulted in the loss of $1.65 million.

Then a perpetual decentralized exchange on Arbitrum called Ostium was the target of an oracle exploit, resulting in the loss of $18 million. Lastly, a malicious governance proposal that was approved resulted in an exploit that cost the BONK ecosystem about $20 million.

Yet despite an increase in attack frequency, DeFiLlama stated that overall losses dropped precipitously to $1 billion as of July 2026 as compared to $2.135 billion seen in the same period in 2025.

Source: DeFiLlama

Final Summary

  • A cross-chain protocol exploit resulted in the loss of 515 million $NIGHT tokens worth $9 million.
  • The exploiter earned access to authorize fake withdrawals by reusing a legitimate signature from a legitimate transaction.