What happened
Wanchain's Cardano–BNB bridge incident was disclosed on July 21 after a July 20 attack that withdrew about 515 million NIGHT from the Cardano-side bridge treasury. Attack-time estimates put the exposure near $10M; the Midnight Foundation said the incident was isolated to Wanchain's bridge infrastructure.
The Cardano bridge validator serialized adjacent variable-length numeric fields without fixed boundaries, separators, or length markers. Different number pairs could therefore produce the same byte sequence and hash, allowing a valid signature for a small withdrawal to be reinterpreted as authorization for a larger one.
Case & protocol details
Attack Timeline
The attacker obtained a legitimate MPC signature for a small cross-chain withdrawal, shifted the byte boundary between adjacent numeric fields, and reused the same signature to authorize a much larger withdrawal. Four withdrawals removed about 515.2M NIGHT from the Cardano-side treasury.
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.