Wanchain bridge on Cardano hacked: 515 million NIGHT tokens stolen — attack analysis by Cryptalist
The crypto community has once again faced a serious security incident: the cross-chain bridge Wanchain, connecting the Cardano and BNB Chain networks, has been exploited. As a result of the attack, approximately 515 million NIGHT tokens were drained from the bridge's treasury. Based on my estimates, at the time of the incident, this amount was valued between $9 and $13 million, highlighting the scale of the damage.
Anatomy of the Hack: How It Happened
The root of the problem, as my analysis of data from BlockSec showed, lies in a critical vulnerability in the TreasuryCheck validator. A validator is a smart contract responsible for verifying the legitimacy of operations. The flaw was in the non-injective encoding of the signed message. In simple terms, this means that different sets of input data could generate the same output byte string. This allowed attackers to manipulate the boundaries of data fields without altering the signature itself.
The exploitation mechanism was as follows:
- The signed message was formed by concatenating 14 variable-length fields (redeemer) without using separators or length prefixes.
- Because of this, different combinations of field values could produce an identical hash (digital fingerprint) and, consequently, the same signature.
- An attacker, possessing a valid signature for one operation, could "shift" the invisible boundaries between fields to interpret the same data as a different, more advantageous transaction for themselves.
This is a classic example of a hash collision attack, where the signature remains valid while the contract logic is distorted.
Market Consequences and Reactions
The market reaction was immediate and painful. The price of the NIGHT token, the native asset of the Midnight project (a privacy-oriented blockchain developed with support from Input Output), collapsed by more than 30% in a day, hitting an all-time low of around $0.016. This clearly demonstrates how vulnerable cross-chain bridges can be—they become a single point of failure for connected ecosystems.
The Wanchain team promptly confirmed the incident, shut down the bridge to conduct an investigation, and promised full transparency. The Midnight Foundation, in turn, hastened to assure the community that the attack affected only the third-party bridge infrastructure, not the Midnight mainnet, its consensus, or protocol. However, the damage to trust has already been done.
My expert conclusion: This hack is yet another reminder that smart contract security, especially in complex cross-chain solutions, requires not just formal audits but deep mathematical analysis for collisions and non-injectivity. Investors should be extremely cautious with tokens whose liquidity is tied to such bridges and closely monitor security updates from developers.