The attack targeted infrastructure operated by Wanchain rather than the Cardano or Midnight blockchains. Midnight Foundation said its network, validators and consensus system remained secure, seeking to contain concern that the breach had compromised the underlying privacy-focused protocol.
The stolen tokens were removed from a treasury address supporting NIGHT transfers across the bridge. Estimates of the loss ranged from $9 million to more than $13 million because the token’s price fell sharply during and after the attack, altering the dollar value of the assets as investigators tracked their movement.
NIGHT dropped by more than 30% during the sell-off and touched a record low near $0.015. The token later recovered part of its losses as exchanges and ecosystem participants moved to restrict the attacker’s ability to deposit, trade or convert the stolen assets.
Blockchain investigators traced the incident to a flaw in the way the bridge encoded data before transactions were authorised. The affected validator contract reportedly combined 14 variable-length fields into a single message without adequate separators or fixed boundaries.
That design allowed different sets of transaction data to produce the same encoded message. Attackers could therefore reuse a valid cryptographic signature while changing critical information, including the number of tokens being redeemed.
A legitimate signature associated with a transfer of about 3,110 NIGHT was allegedly manipulated to approve withdrawals exceeding 200 million tokens in one operation. Further transactions brought the total removed from the treasury to about 515 million NIGHT.
The process unfolded within minutes, highlighting the speed at which automated transactions can empty bridge reserves once verification controls are bypassed. Wanchain halted the relevant bridge service after the abnormal activity was detected and began working with security specialists, exchanges and the Midnight team.
Several large cryptocurrency exchanges restricted NIGHT deposits and withdrawals or blocked addresses linked to the stolen funds. The measures were intended to prevent the attacker from converting the assets through centralised trading platforms, although tokens can also be exchanged through decentralised venues that lack central account controls.
Some of the stolen NIGHT was moved through Cardano-based decentralised exchanges, adding selling pressure and contributing to the price decline. Investigators continued to follow the assets across wallets while attempting to identify destinations that could be frozen or flagged.
The incident exposed a mismatch between Wanchain’s established operating history and the vulnerabilities that can emerge when new assets and chains are added to cross-chain systems. Founded in 2017, Wanchain has positioned itself as a decentralised interoperability network connecting dozens of blockchain platforms, including both Ethereum-compatible and non-Ethereum networks.
Cross-chain bridges lock tokens on one network and issue equivalent assets on another, enabling users to move value between otherwise separate blockchains. The design places substantial assets in bridge contracts and treasury addresses, making them attractive targets for hackers.
Bridge security depends not only on the blockchains being connected but also on smart contracts, validators, signing procedures, message formats and off-chain services. A weakness in any one component can allow attackers to create tokens without proper backing or withdraw assets that were deposited by legitimate users.
The Wanchain breach did not represent an attack on Cardano’s consensus mechanism. Cardano continued processing transactions normally, while Midnight’s core infrastructure also remained operational. The distinction is important because assets carrying a blockchain’s name can be affected by third-party applications without the base network being penetrated.
Midnight is a privacy-oriented blockchain developed with support from Input Output, the company behind Cardano. Its architecture is designed to let applications protect confidential information while providing selective disclosure and regulatory controls. NIGHT is used for network participation and supports the generation of DUST, a resource intended to pay for transactions without exposing users’ identities.
The exploit has renewed scrutiny of older bridge models that rely on trusted signers or complex message validation. Cardano founder Charles Hoskinson said the sector should move towards bridge designs based on zero-knowledge technology, which can verify transactions cryptographically while reducing dependence on operators and multisignature arrangements.
Security specialists have repeatedly warned that bridge contracts require strict data encoding, domain separation and safeguards against signature replay. Signed messages must bind every transaction field clearly to its type, length, destination chain and intended contract so that approval for one action cannot be applied to another.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
