Relay_Station / Zone_39
TECH
21.07.2026
Wanchain Cardano Bridge Drains $13 Million via Signature Reuse Flaw
Blockchain security firm BlockSec Phalcon was quick to identify the root cause, pinpointing a “non-injective signed-message encoding flaw” as the primary vector. This sophisticated vulnerability allowed an attacker to manipulate the bridge’s logic by reusing a legitimate, small-value signature to authorize significantly larger transfers. Specifically, reports indicate that a signature originally meant for approximately 3,110 NIGHT tokens was inflated to extract over 203 million NIGHT in a single transaction, representing a 65,000x multiplication effect on the authorized amount.
The attacker executed the illicit transfers over a series of eight transactions, all routed through the same contract pair and ultimately consolidating the stolen assets into a single wallet address. Following the rapid drainage of the Wanchain Liquidity Pool (OLP) vault, the perpetrator moved swiftly to launder the stolen funds, utilizing the cryptocurrency mixer TornadoCash. The swift laundering operation complicates recovery efforts and tracing of the illicit proceeds.
Wanchain's team confirmed the breach and promptly took the affected Cardano-to-BNB Chain bridge offline to mitigate further damage and conduct a thorough investigation. The bridge, which has reportedly operated for over eight years across dozens of blockchains without a major incident, was integrated with Cardano as part of a broader initiative to enhance its cross-chain capabilities and support the Midnight network.
The Midnight Foundation, while acknowledging the incident, moved to assure its community that the exploit was isolated entirely to the third-party bridge infrastructure. The foundation explicitly stated that the Midnight network itself, along with its validators, consensus mechanism, and core protocol, remained fully secure and unaffected by the breach. This distinction is crucial for maintaining confidence in the underlying Midnight blockchain, even as its bridged assets faced compromise.
The technical flaw lay in how the TreasuryCheck validator constructed messages for signing. Instead of using clear delimiters or length prefixes for its 14 variable-length redeemer fields, the Wanchain bridge built its signed messages by raw concatenation. This design vulnerability allowed different combinations of field values to produce an identical byte string and hash, enabling the attacker to replay or reuse signatures for inflated amounts. The system validated only the signer's identity, not the accuracy or plausibility of the associated transaction data.
The immediate impact on the market was severe for NIGHT holders. The token's price plummeted more than 30% to a record low near $0.016 within 24 hours of the news breaking, triggering heavy selling pressure. This sharp decline reflects the market's reaction to the sudden loss of collateral backing the wrapped NIGHT tokens circulating on BNB Chain, creating significant uncertainty for holders.
This incident adds to a troubling pattern of bridge exploits in 2026. Just a month prior, Humanity Protocol reportedly suffered a $31 million exploit due to compromised multisig wallet keys controlling its Ethereum and BNB Chain bridges. Furthermore, Gnosis Pay confirmed a $1.8 million attack in June via a Zodiac module vulnerability. These recurring security breaches highlight the inherent complexities and vulnerabilities in cross-chain bridge designs, which often hold large pools of assets and rely on intricate verification systems between disparate networks.
Wanchain has not yet published a detailed compensation or restoration timeline, leaving many questions unanswered for affected users. While investigations are ongoing, the immediate focus remains on securing the compromised infrastructure and understanding the full extent of the technical breach. How Wanchain plans to address the structural flaw and restore trust in its cross-chain mechanisms will be a critical test for the protocol in the coming weeks.
Signals elevate this to HOT_INTEL priority.
// Related_Intel
More_Signals
‹ Return_to_Terminal
Traffic_Nodes
0
Mobile_Relay / Zone_37