Crypto news

The Wanchain bridge, which facilitates interoperability between the Cardano and BNB Chain networks, was subjected to a targeted attack. As a result of the incident, approximately 515 million NIGHT tokens were withdrawn from the bridge's treasury. At the time of the attack, this amount was valued at roughly $13 million, although some analysts provide a more conservative estimate of around $9 million.

Root Cause: Ambiguous Signature Encoding

A preliminary analysis conducted by security experts points to a critical vulnerability in the implementation of the TreasuryCheck validator. The issue lies in the ambiguous encoding of the signed message. A validator is a smart contract that checks whether a transaction can be approved. "Ambiguous encoding" means that different sets of input data can lead to the same output string. Simply put, the system loses its ability to distinguish between different operations.

The attack mechanism was as follows:

• The signed message was formed by "raw" concatenation of 14 variable-length fields from the redeemer data (a set of data attached to a transaction to verify its legitimacy) without using delimiters or length prefixes. The AppendByteString function was used.
• Because of this, different sets of field values could produce the same byte string.
• An identical byte string means an identical hash (digital fingerprint) and, consequently, the same signature, suitable for reuse.

For clarity: imagine a director approved the digital combination "12345" and certified it with their signature. The verification program splits the combination into two fields: "to whom" and "how much." As intended by the director, "to whom" = 12, "how much" = 345. But the combination itself does not specify where the boundary lies. The combination "12345" can be split differently: "to whom" = 123, "how much" = 45. The digits remain untouched, the combination is the same, the signature is authentic — but the recipient and the amount turn out different. This is precisely how the attack was constructed: the attacker did not forge the signature but merely "shifted" the invisible boundary between the fields.

Decompilation of the on-chain Plutus V2 bytecode confirmed the presence of the built-in SerialiseData function, but it was only used in the output-datum matching path, not when constructing the hash for the signature. Applying Sha3_256(SerialiseData(...)) would have ensured unambiguous field boundaries in CBOR encoding and prevented this class of signature reuse attacks.

According to analysts, the attackers forged messages to improperly mint tokens and then exchanged the withdrawn funds for ADA on the Cardano network.

The Wanchain team confirmed the incident, disabled the bridge to conduct an investigation, and promised full transparency and a detailed report upon its conclusion.

Market Reaction and Midnight Foundation's Stance

NIGHT is the native token of the Midnight project, a privacy-focused blockchain solution developed with support from Input Output (IO), the company behind Cardano. News of the attack caused a sharp drop in NIGHT's price of over 30% within the day, hitting an all-time low near the $0.016 mark.

The Midnight Foundation emphasized that the incident is isolated within the Wanchain Cardano-BNB bridge and does not affect the Midnight network itself. The protocol, validator network, consensus mechanism, and key infrastructure remain secure and operational. The Foundation is in close contact with Wanchain and believes the incident does not change the security level or operational integrity of the Midnight network.

Cryptalist Analytical Commentary: This incident is yet another painful reminder that bridges remain one of the most vulnerable points in DeFi infrastructure. The vulnerability related to ambiguous encoding is not new, but its recurrence in such a significant project as Wanchain points to a systemic problem with the quality of smart contract auditing and testing. NIGHT's 30% drop is an expected market reaction to the loss of liquidity, but the long-term consequences for the Midnight project itself will depend on how quickly and effectively Wanchain can compensate for the damage and restore user trust.