Root Cause: Non-Injective Message Encoding

On July 21, 2026, Wanchain's Cardano–BNB cross-chain bridge was exploited for approximately 515 million NIGHT tokens, valued at roughly $9 million [Source: https://x.com/Phalcon_xyz/status/2079443108027421183]. The incident was caused by a technical flaw in the bridge's smart contract validation process, which allowed an attacker to inflate a legitimate withdrawal signature by approximately 65,000x.

Root Cause: Non-Injective Message Encoding

The vulnerability resided in the TreasuryCheck validator on the Cardano side of the bridge. Security analysis revealed that the validator constructed messages by concatenating 14 different data fields of varying lengths without using delimiters or recording field lengths [Source: https://x.com/Phalcon_xyz/status/2079443108027421183].

This created a non-injective encoding flaw: because there were no clear boundaries between fields, different sets of input data could result in the same final byte string. While Cardano's SerialiseData function could have prevented this by properly structuring the data, it was not utilized during the signature hash construction [Source: https://x.com/Phalcon_xyz/status/2079443108027421183].

Exploit Mechanism: Signature Reuse and Inflation

The attacker leveraged this encoding flaw to perform a signature reuse attack through the following steps:

1. Obtaining a Valid Signature: The attacker initiated a legitimate withdrawal on the BNB Chain for a small amount—approximately 3,110 NIGHT tokens [Source: https://x.com/Phalcon_xyz/status/2079443108027421183].
2. Replaying on Cardano: Due to the lack of field delimiters, the attacker manipulated the data fields such that the original signature remained valid for a vastly larger amount on the Cardano side.
3. Inflation: The attacker successfully replayed the signature to authorize a withdrawal of 203 million NIGHT tokens in a single transaction—an inflation of roughly 65,000x [Source: https://x.com/Phalcon_xyz/status/2079443108027421183].
4. Drain: This process was repeated until the bridge treasury was drained of 515 million tokens.

Impact and Response

The exploit had immediate market and operational consequences:

Wanchain halted the Cardano–BNB bridge immediately following the discovery to investigate and remediate the validator flaw. The Midnight Foundation confirmed that the incident was strictly limited to the Wanchain bridge infrastructure and did not compromise the security of the Midnight Network itself [Source: https://x.com/midnightfdn/status/2079306216564539796].