{"id":"wanchain-cardano-bnb-bridge-theft-jul-2026","category":"breach","status":"closed","title":"Wanchain Cardano–BNB bridge loses about 515 million NIGHT tokens (US$9–13 million)","tldr":"Wanchain's Cardano–BNB bridge lost about 515 million NIGHT tokens (US$9–13 million) on 20 July 2026 through a signature flaw. The bridge is offline. No return of funds is confirmed. Don't use this bridge; wait for Wanchain's own announcements.","summary":"On 20 July 2026, about 515.2 million NIGHT tokens were taken from the Cardano side of Wanchain's bridge between Cardano and BNB Chain. Published values range from US$9 million to US$13 million, depending on whether the pre-theft or the sell-off price is used. BlockSec's preliminary analysis, as reported, found that the bridge's TreasuryCheck validator joined 14 variable-length fields with no separators. That let a valid signature for a withdrawal of about 3,110 NIGHT be reused to release 203,001,692 NIGHT. Wanchain took the bridge offline. The Midnight Foundation said the Midnight network and its consensus were unaffected, and reports describe the problem as limited to the third-party bridge. NIGHT fell more than 30% to a record low. Wanchain offered the attacker a 10% bounty to return the rest by 6 August 2026 and promised no civil claims. Our sources do not confirm that any funds were returned, and the bridge had no restart date at the last check. This is a theft from a service, so there is no software update to install. Wanchain had not published a full post-mortem in the sources we read. The Midnight Foundation statement could not be loaded when we tried, so it is not relied on directly.","action":"Nothing to update. If you hold NIGHT through the Wanchain bridge, don't send more through it and follow Wanchain's official channels for the restart and any plan for affected users. Be wary of anyone offering to recover your funds.","product":"Wanchain Cardano–BNB Chain bridge (NIGHT token)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["wanchain","cardano","bnb-chain","night","midnight","crypto-theft","bridge","signature-flaw"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Wanchain Cardano–BNB Chain bridge hack","url":"https://itokenly.com/hacks/wanchain-cardano-bnb-bridge","by":"iTokenly","date":"2026-08-01"},{"kind":"news","title":"Wanchain Cardano-BNB bridge exploit: $9M stolen","url":"https://tangem.com/en/news/security/34030-wanchain-cardano-bnb-bridge-exploit-9m-stolen/","by":"Tangem","date":"2026-07-21"},{"kind":"advisory","title":"Update on the Wanchain Cardano-BNB bridge incident","url":"https://www.midnight.foundation/news/update-on-the-wanchain-cardano-bnb-bridge-incident","by":"Midnight Foundation","date":"2026-07-21"}],"started":"2026-07-20","closed":"2026-08-01","created":"2026-11-03T21:31:07.590Z","updated":"2026-11-03T21:31:07.590Z","cve_notes":[],"timeline":[{"at":"2026-08-01","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Wanchain offered the attacker a 10% white-hat bounty to return the other 90%, with a deadline of 12:00 UTC on 6 August 2026 and a pledge not to pursue civil claims. The bridge was still offline with no restart date, and no technical post-mortem had been published.","url":"https://itokenly.com/hacks/wanchain-cardano-bnb-bridge","by":"iTokenly","patch":"na"},{"at":"2026-07-21","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"The theft became public. Wanchain disabled the bridge and began an investigation. BlockSec's preliminary finding was a flaw in the bridge's TreasuryCheck validator, which joined 14 variable-length fields with no separators. NIGHT fell more than 30% in 24 hours. Reports said the Midnight and Cardano core networks were not affected.","url":"https://tangem.com/en/news/security/34030-wanchain-cardano-bnb-bridge-exploit-9m-stolen/","by":"Tangem","patch":"na"},{"at":"2026-07-20","added":"2026-11-03T21:28:26.316Z","kind":"disclosed","text":"Between about 14:46 and 14:55 UTC, roughly 515.2 million NIGHT tokens were withdrawn from the Cardano side of Wanchain's Cardano–BNB Chain bridge. One signature for a withdrawal of about 3,110 NIGHT was reused to release 203,001,692 NIGHT.","url":"https://itokenly.com/hacks/wanchain-cardano-bnb-bridge","by":"iTokenly","patch":"na"}],"url":"https://hard.fyi/live/wanchain-cardano-bnb-bridge-theft-jul-2026/","json":"https://hard.fyi/api/live?id=wanchain-cardano-bnb-bridge-theft-jul-2026"}