Wanchain disabled its Cardano-BNB Chain bridge after approximately 515 million NIGHT tokens were withdrawn from the bridge treasury in a series of unauthorized transactions.
The bridge is unavailable while Wanchain investigates the transfers. The project confirmed the NIGHT withdrawals and said it would release further details after completing its review.
The affected tokens were held on Cardano to support cross-chain transfers between Cardano and BNB Chain. The withdrawals did not increase NIGHT’s total supply, but removed assets backing the bridge’s cross-chain operations.
At a NIGHT price near $0.019, the transferred balance carried a market value of roughly $9.8 million. The value of the assets when withdrawn and any amount realized through subsequent sales may differ because NIGHT fell sharply during the transfers.
BlockSec Traces Possible Signature-Reuse Attack
BlockSec’s preliminary analysis identified a possible flaw in the TreasuryCheck validator used by the Cardano bridge.
The validator reportedly created signed messages by combining 14 variable-length fields without clear separators or length prefixes. Different combinations of field values could therefore produce the same encoded message, allowing a valid signature from one bridge transaction to be reused with altered withdrawal data.
BlockSec traced one reused identifier to a legitimate BNB Chain transaction authorizing approximately 3,110 NIGHT. The same signature was then accepted on Cardano for a withdrawal of more than 203 million NIGHT, producing an amount roughly 65,000 times larger.
The security firm examined the bridge’s Plutus V2 code and the transactions associated with the withdrawals. Wanchain had not released a technical postmortem or confirmed the final attack path at publication.
The drain follows a $1.65 million flash-loan exploit at Allbridge Core and pushes estimated losses from bridge-related exploits beyond $328.6 million this year.
NIGHT Falls As Midnight Separates Network From Bridge
NIGHT fell to an intraday low near $0.0158 before recovering toward $0.019, leaving the token down about 26% over 24 hours. Trading volume climbed above $140 million as the withdrawn tokens moved through Cardano markets.
The Midnight Foundation said the withdrawals were confined to Wanchain’s third-party bridge infrastructure. Midnight’s blockchain, validators, consensus system and core protocol continued operating normally.
NIGHT is Midnight’s native utility and governance token and generates DUST, the network resource used for transactions and smart-contract execution. The token has a fixed total supply of 24 billion, placing the withdrawn bridge balance at about 2.1% of total supply.
