Technical Mechanism and Root Cause

The signature-reuse exploit on Wanchain’s Cardano–BNB bridge, occurring on July 21, 2026, has severely undermined cross-chain trust by demonstrating that even established bridges with long-standing uptime can fail due to fundamental encoding errors. The exploit resulted in the theft of 515 million NIGHT tokens (approximately $13 million), causing the token price to drop 30% to roughly $0.016 [Source: https://x.com/Joshuwa/status/2077273663749988846].

Technical Mechanism and Root Cause

The vulnerability stemmed from a design flaw in the TreasuryCheck validator. The bridge used raw byte concatenation for 14 variable-length fields within signed messages without using delimiters or length prefixes. This created a non-injective encoding environment where different data inputs could produce the same hash.

An attacker leveraged a legitimate signature for a small withdrawal (~3,110 NIGHT) and manipulated the field boundaries to generate a new set of parameters. Because the resulting hash remained identical, the system accepted the signature for a massive withdrawal of 203 million NIGHT in a single transaction—a 65,000x inflation effect. Analysts suggest that implementing CBOR encoding (e.g., SerialiseData) would have prevented this by enforcing strict field boundaries.

Impact on Cross-Chain Trust

This incident is particularly damaging to Wanchain’s reputation, as the project had previously claimed a record of 100% uptime for over eight years [Source: https://x.com/Joshuwa/status/2077273663749988846].

• Bypass of Advanced Security: The exploit bypassed Wanchain’s Storeman nodes and Threshold Signature Schemes (TSS). This proves that robust cryptographic primitives are insufficient if the application-layer data serialization is flawed.
• Isolation of Impact: While the bridge treasury was compromised, the underlying Midnight network consensus and the Cardano blockchain remained secure.
• Market Sentiment: The immediate 30% price collapse of the NIGHT token reflects a sharp loss in investor confidence regarding the bridge's ability to secure cross-chain assets.

Comparison of Bridge Security Metrics

The following table summarizes the immediate impact of the exploit as of July 21, 2026:

Ecosystem Implications

The Wanchain exploit contributes to a growing "bridge security fatigue" within the DeFi ecosystem, following other 2026 exploits like those on Humanity Protocol and Gnosis Pay.

There are conflicting reports regarding Wanchain's market position: while some narratives suggested the project was a candidate for major exchange listings, data indicates that Wanchain (WAN) was actually delisted by Swyftx in April 2026, suggesting that institutional trust may have been wavering even prior to this technical failure. Furthermore, while some reports mention a clarifying statement from the Midnight Foundation to stabilize the core network, this has not been independently confirmed.

The bridge remains offline as of the latest research data, and a full restoration of trust is expected to require a comprehensive third-party audit and a transparent post-mortem of the serialization logic.