WanBridge 2026 Cardano–BNB NIGHT exploit
Approximately 515 million NIGHT were reported drained from the Cardano side of the third-party Wanchain Cardano–BNB Chain bridge on July 20, 2026. Midnight Foundation confirmed that the incident was isolated to Wanchain bridge infrastructure rather than the Midnight network or NIGHT supply. Independent security tracking classifies the bridge incident as a smart-contract vulnerability and records a bridge suspension; detailed reporting describes a signed-message verification design failure. Recovery, reimbursement, and a dated restart of the affected route remain unresolved.
Incident facts
- Incident title
- WanBridge 2026 Cardano–BNB NIGHT exploit
- Bridge
- WanBridge
- Incident date
- 2026-07-20
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Cardano, BNB Chain
- Affected assets
- NIGHT
- Attack category
- Smart Contract Bug
- Reported loss
- Independent security and technical reporting records approximately 515 million NIGHT drained from the Cardano side of the bridge.
- Amount confidence
- Medium
- Loss amount basis
- Mixed Sources
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Paused
- Current outcome
- Unknown
- Postmortem
- Available
- Resolution
- Unresolved
- Last reviewed
- 2026-08-18
- Last verified
- 2026-08-18
Amount and valuation
Independent security and technical reporting records approximately 515 million NIGHT drained from the Cardano side of the bridge.
BIR retains the token-denominated amount and does not canonicalize a USD conversion because contemporaneous dollar estimates vary materially by valuation point.
approximately 515 million NIGHT drained
SlowMist reports the approximate token quantity; no USD amount is promoted into the canonical loss field.
Why this remains unresolved
- Midnight Foundation described an ongoing coordinated investigation and exchange restrictions but did not establish a completed recovery amount.
- The admitted evidence package does not establish reimbursement or liability treatment for affected bridged NIGHT.
- Independent security tracking records a bridge suspension, but a dated restart or redeployment of the affected Cardano–BNB NIGHT route is not established.
Timeline events
WanBridge Cardano–BNB NIGHT route exploited2026-07-20
Technical reporting places the drain on July 20, 2026 and records roughly 515 million NIGHT leaving the Cardano side of the Wanchain bridge. Midnight Foundation confirmed that the incident was isolated to Wanchain bridge infrastructure, while independent security tracking classifies the incident as a smart-contract vulnerability and records a bridge suspension.
The broader WanBridge service being reachable is not treated as proof that the affected Cardano–BNB NIGHT route reopened.
Evidence records
- Update on the Wanchain Cardano–BNB Bridge IncidentMidnight Foundation · Tier 1 · High reliability · primary · 2026-07-21Claim scope: Incident Case
First-party affected-ecosystem statement confirming that NIGHT was stolen through Wanchain third-party bridge infrastructure, the incident was isolated to the Wanchain bridge rather than Midnight protocol/network/supply, and multiple exchanges restricted or froze incident-linked assets while investigation continued.
- Wanchain Cardano-BNB Chain BridgeSlowMist · Tier 2 · High reliability · secondary · 2026-07-21Claim scope: Incident Case
Independent security-incident database entry supporting the approximately 515 million NIGHT drain, Cardano-side bridge scope, bridge suspension, and smart-contract-vulnerability classification. Its USD valuation is not promoted because contemporaneous valuations vary.
- Weekly Brief #16 — the thing that broke was a bridgeSIPO · Tier 2 · Medium reliability · secondary · 2026-07-25Claim scope: Incident Case
Dated technical incident account supporting the July 20 transaction boundary, approximately 515 million NIGHT drain, Cardano-to-BNB route scope, signature-verification design failure, and bridge-offline state. It explicitly distinguishes July 20 on-chain activity from July 21 publication dates used by some reports.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The exact amount, if any, ultimately recovered or frozen after exchange coordination is not established in the admitted evidence package.
- A dated restart or redeployment of the affected Cardano–BNB NIGHT route is not established by the admitted evidence package.
- A canonical USD loss value is intentionally omitted because contemporaneous valuations vary.
- Wanchain published a first-party technical postmortem, but its Medium URL had zero reproducible Wayback captures in the bounded 2026-08-18 archive review. The postmortem remains review authority in Issue #304 but is not admitted as canonical evidence until it satisfies the existing preservation gate.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.