Technical Root Cause: Non-Injective Encoding

On July 21, 2026, Wanchain's Cardano-to-BNB Chain bridge was exploited for approximately 515 million NIGHT tokens, valued at roughly $9 million USD [Source: https://crypto.news/wanchain-cardano-bridge-exploit-drains-515m-night-worth-9m/]. The exploit was caused by a technical flaw in the bridge's signature verification process, specifically a non-injective signed-message encoding vulnerability within the TreasuryCheck validator [Source: https://x.com/DrCrypto76/status/2079487941752086660].

Technical Root Cause: Non-Injective Encoding

The core of the issue lay in how the bridge's smart contract (written in Plutus V2) prepared data for signing. The TreasuryCheck validator used a raw concatenation method to combine 14 variable-length fields into a single byte string for signature verification [Source: https://x.com/CheekyCrypto/status/2079472634874802507].

• The Flaw: The validator used an AppendByteString fold operation to join these fields without any separators, delimiters, or length markers [Source: https://x.com/CheekyCrypto/status/2079472634874802507].
• The Consequence: This created a "non-injective" mapping, meaning multiple different combinations of field data could result in the exact same final byte string.
• The Attack: An attacker was able to reorganize the values within these 14 fields in a way that the resulting concatenated string remained identical to a previously valid transaction. This allowed the attacker to reuse a valid signature to authorize a new, malicious withdrawal from the bridge treasury [Source: https://x.com/BSCNews/status/2079479491361902800].

Impact and Mitigation

The exploit was isolated to Wanchain's third-party bridge infrastructure; the core Midnight Network protocol, its validators, and consensus mechanisms remained secure [Source: https://x.com/niroshan682/status/2079480237289599278].

Security analysts noted that while the contract contained the SerialiseData function, it was not utilized for the signature hash. Implementing Sha3_256(SerialiseData(...)) would have provided clear, structured boundaries for each field, preventing the signature reuse attack entirely [Source: https://x.com/CheekyCrypto/status/2079472634874802507].