Wanchain exploit analysis

On 20 July 2026, an attacker exploited the Wanchain bridge to steal 515 million NIGHT tokens that had been bridged from Cardano to BNB. The NIGHT token is the native asset of Midnight, a privacy-focused blockchain linked to Cardano. The stolen tokens were worth $9 million to $10 million at the time of the theft, though the massive token outflow caused NIGHT's price to drop by approximately 43% in the immediate aftermath.

The mechanism was a vulnerability in the Wanchain bridge that the protocol's own incident-response team — BlockSec's Phalcon — observed in real time. The Phalcon tweet thread identified the exploit but did not publish a step-by-step technical breakdown in the reviewed sources. The bridge is an inter-chain message-passing system that moves token balances between chains by locking them on the source and minting equivalent balances on the destination. A flaw in either the locking logic on Cardano or the minting logic on BNB could have allowed an attacker to mint unbacked NIGHT, or to withdraw NIGHT that had not been properly locked. The fact that the stolen tokens had been bridged from Cardano to BNB means the attacker was able to exploit the bridge's cross-chain accounting after the tokens had been moved.

The figures are mostly stable. The web3isgoinggreat account put the loss at "$9 million to $10 million". The Phalcon tweet thread referenced the same approximate range. The Midnight Foundation's tweet thread acknowledged the theft without giving a contradicting figure. The 43% price drop in NIGHT is reported consistently across sources.

The response was a public disclosure from Midnight Foundation and a tweet thread from Phalcon documenting the attack. No recovery has been reported. The NIGHT token continued trading.

Compared with the other 2026 bridge incidents in the corpus, the Wanchain-Midnight case sits with the Across Protocol relayer loss of $3.35 million, the Allbridge flash loan drain of $1.66 million, the Payy Network bridge drain of $1.8 million, and the Liquid Network unauthorised withdrawal of $320 million as another bridge-related compromise in 2026. Of the five, the Wanchain case is the second-largest by exploit size at $9-10 million. The cross-chain nature — tokens bridged from Cardano to BNB — is consistent with the Wanchain protocol's design purpose. The same week saw the Across and Allbridge incidents, and the protos.com coverage of that week framed the three as a single-week cluster of bridge compromises.