Wanchain's Cardano Bridge Loses 515.2M NIGHT

Wanchain suspended access to its Cardano bridge on Monday after an attacker withdrew roughly 515.206 million NIGHT tokens, about 2.15% of the token's 24 billion supply, in a nine-minute window between 14:46 and 14:55 UTC. The weakness sat in how the bridge assembled the messages its validators sign: a legitimate signature covering approximately 3,110 NIGHT was made to authorize a withdrawal of about 203 million NIGHT, more than 65,000 times the amount it had been issued for. No validator keys were compromised. No cryptography was broken. What the haul was worth is another matter. Dollar estimates run from $500,000 to around $10 million, more than an order of magnitude apart, because NIGHT's price fell sharply during and after the drain.

Fourteen fields run together, nothing between them

The bridge's TreasuryCheck validator built each message to be signed by concatenating 14 variable-length fields with no separators and no length prefixes marking where one field ended and the next began. That makes the encoding non-injective: two different sets of inputs can collapse into the identical string of bytes, so a signature produced over one set is also a mathematically valid signature over the other. This is not a break in the signing algorithm. The signature was properly formed and produced by a legitimate key over a message the validators genuinely agreed to; what failed was the step that turns a withdrawal's details into the bytes being signed.

The practical effect was that the bridge accepted a validly formed signature and read it as authorizing something other than what its signers had approved. A small, ordinary withdrawal of about 3,110 NIGHT carried an authorization that could be re-read as covering roughly 203 million. Because the signature itself checked out, every control that examines signatures passed. The gap sat in the layer beneath, where meaning is attached to bytes, and that layer had no way to tell the two withdrawals apart.

One token count, three dollar figures

The quantity taken is not in dispute; the valuation of it is. Roughly 515.206 million NIGHT left the bridge, equal to about 2.15% of supply, and every account agrees on that. Converting the tokens into dollars produces three materially different answers, each attached to a different source:

$500,000, in the incident writeup published by the security firm BlockSec.
$6.5 million, in a tally derived from DefiLlama data and reported by coinpaper.
Roughly $9 million to $13 million, per Crypto Times, which described about $10 million as the widely reported figure.

BlockSec's number does not reconcile with the figure Crypto Times calls widely reported, and neither confirms the tally in between. We could not establish which valuation comes closest. The spread mostly reflects timing: NIGHT's price collapsed during the drain and kept falling afterward. A valuation struck at the moment of the first withdrawal and one struck a day later describe the same 515.206 million tokens at very different prices.

A second bridge in two days

Monday's incident arrived a day after another bridge lost $1.65 million, when Allbridge Core's swap instruction accepted the same pool account in two roles it should have kept distinct. Bridges have been the sector's recurring weak point for months: Taiko halted its Ethereum layer-2 network in June after forged withdrawal proofs drained about $1.7 million from its bridge and token vault. In each case the cryptography held. The plumbing around it did not.

Containment after the fact

Wanchain halted bridge access once the withdrawals were identified, and had published no final technical post-mortem, recovery plan or compensation framework by the end of Monday. The nine-minute window frames the detection problem: the drain was over long before any human response was possible, so containment amounted to closing the door afterward. For NIGHT holders the open questions are whether the loss figure converges as the token's price settles and what, if anything, is offered to those affected. Other bridge operators face a narrower and more actionable question — whether their own signed messages delimit their fields, or simply run them together.