Wanchain's Cardano Bridge Loses 515.2M NIGHT

Wanchain suspended access to its Cardano bridge on Monday after an attacker withdrew roughly 515.206 million NIGHT tokens, about 2.15% of the token's 24 billion supply, during a nine-minute window between 14:46 and 14:55 UTC. The weakness sat in how the bridge assembled the messages its validators sign: a legitimate signature covering approximately 3,110 NIGHT was made to authorize a withdrawal of about 203 million NIGHT, more than 65,000 times the amount it had been issued for. No validator keys were compromised and no cryptography was broken. Dollar estimates of the loss differ by more than an order of magnitude, from $500,000 to around $10 million, because NIGHT's price fell sharply during and after the drain.

The Encoding: Fourteen Fields Run Together With Nothing Between Them

The bridge's TreasuryCheck validator built each message to be signed by concatenating 14 variable-length fields with no separators and no length prefixes marking where one field ended and the next began. That makes the encoding non-injective: two different sets of inputs can collapse into the identical string of bytes, so a signature produced over one set is also a mathematically valid signature over the other. A signature-encoding flaw of this kind is not a break in the signing algorithm. The signature was properly formed and produced by a legitimate key over a message the validators genuinely agreed to; what failed was the step that turns a withdrawal's details into the bytes being signed.

The practical effect is that the bridge accepted a validly formed signature and interpreted it as authorizing something other than what its signers had approved. A small, ordinary withdrawal of about 3,110 NIGHT carried an authorization that could be re-read as covering roughly 203 million. Because the signature itself checked out, every control that examines signatures passed. The gap was in the layer beneath, where meaning is attached to bytes, and that layer had no way to tell the two withdrawals apart.

The Numbers: One Token Count, Three Dollar Figures

The quantity taken is not in dispute and the valuation of it is. Roughly 515.206 million NIGHT left the bridge, equal to about 2.15% of supply, and every account agrees on that. Converting the tokens into dollars produces three materially different answers, each attached to a different source:

$500,000, in the incident writeup published by the security firm BlockSec.
$6.5 million, in a tally derived from DefiLlama data and reported by coinpaper.
Roughly $9 million to $13 million, per Crypto Times, which described about $10 million as the widely reported figure.

These accounts differ, and none of them can be treated as the settled number. The spread mostly reflects timing: NIGHT's price collapsed during the drain and kept falling afterward, so a valuation struck at the moment of the first withdrawal and one struck a day later describe the same 515.206 million tokens at very different prices.

The Pattern: A Second Bridge in Two Days

Monday's incident arrived a day after another bridge lost $1.65 million, when Allbridge Core's swap instruction accepted the same pool account in two roles it should have kept distinct. Bridges have been the sector's recurring weak point for months: Taiko halted its Ethereum layer-2 network in June after forged withdrawal proofs drained about $1.7 million from its bridge and token vault. The common thread across all three is that the cryptography held and the plumbing around it did not.

What Is Unresolved: Bridge Access Down and No Post-Mortem

Wanchain halted bridge access once the withdrawals were identified, and had published no final technical post-mortem, recovery plan or compensation framework by the end of Monday. The nine-minute window is worth noting for what it says about detection: the drain was over long before any human response was possible, so containment amounted to closing the door afterward. For NIGHT holders the open questions are whether the loss figure converges as the token's price settles and what, if anything, is offered to those affected. For other bridge operators the question is narrower and more actionable — whether their own signed messages delimit their fields, or simply run them together.