What happened
Wanchain's Cardano–BNB bridge incident was disclosed on July 21 after a July 20 attack that withdrew about 515 million NIGHT from the Cardano-side bridge treasury. Attack-time estimates put the exposure near $10M; the Midnight Foundation said the incident was isolated to Wanchain's bridge infrastructure.
The Cardano bridge validator serialized adjacent variable-length numeric fields without fixed boundaries, separators, or length markers. Different number pairs could therefore produce the same byte sequence and hash, allowing a valid signature for a small withdrawal to be reinterpreted as authorization for a larger one.
How it happened
The attacker obtained a legitimate MPC signature for a small cross-chain withdrawal, shifted the byte boundary between adjacent numeric fields, and reused the same signature to authorize a much larger withdrawal. Four withdrawals removed about 515.2M NIGHT from the Cardano-side treasury.
Protocol details
Evidence
- report @wanchain_org incident report x.com
- report @coinminutes_en incident report x.com
- report @CertiKAlert incident report x.com
- report Wanchain — Cardano ↔ BNB Chain Bridge Incident Post-Mortem medium.com
- report Cheeky Crypto — Wanchain Cardano Bridge forensic report portal.cheekycrypto.io
- analysis DeFiLlama defillama.com
- analysis Midnight Foundation — Wanchain bridge incident update midnight.foundation
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
