5.15 billion NIGHT tokens drained from a single locking address. Reserve drops from 527 million to 12 million in nine minutes. Price crashes 27% to an all-time low of $0.01524.
If you think this is just another bridge hack, you haven't looked at the on-chain data closely enough. Attackers didn't break the bridge's consensus—they emptied a vault with surgical precision, leaving every other asset untouched. This isn't a code exploit; it's a centralized custody failure dressed in smart contract clothing.
Let me walk you through the mechanics, the hidden signals, and why the market is still underpricing the second wave of selling.
Context: The Lock-and-Mint Trap
Wanchain operates a classic lock-and-mint bridge between Cardano and BNB Chain. Users deposit native NIGHT on Cardano into a locking address controlled by Wanchain. In return, they receive wrapped NIGHT (wNIGHT) on BNB Chain for DeFi use. The entire system relies on one assumption: the locking address holds enough native NIGHT to back every wNIGHT in circulation.
This model is the industry's oldest single point of failure. Compare it to LayerZero’s decentralized oracle network or Wormhole’s guardian consensus—both distribute trust across multiple parties. Wanchain chose the legacy path: one wallet, one private key (or a set of keys managed by a small team), and a promise of security.
As of July 2026, that promise is broken.
Core Analysis: The Code That Didn't Care
Attack timeline (UTC, July 2026): - 14:46 – First abnormal withdrawal from the locking address on Cardano. - 14:55 – 5.15 billion NIGHT transferred out in a single transaction block. - 15:30 – Wanchain pauses the bridge. (Too late—the damage took nine minutes.)
The attacker moved with precision. They drained 97% of the NIGHT reserve instantly. Every other bridged asset—ADA, USDC, ETH—remained untouched. That selectivity tells me the vulnerability was NIGHT-specific, not a general bridge logic flaw.
Possible root causes (based on my audit experience with 0x Protocol in 2017): - Token contract exploit: A reentrancy or missing access control in NIGHT’s transfer logic allowed the attacker to call the bridge’s unlock function without a corresponding lock. I've seen this pattern before—projects rush to deploy token contracts, leaving hooks that bypass the bridge. - Private key compromise: The locking address was controlled by Wanchain’s multisig or a single admin EOA. If the attacker gained access to that key, they could withdraw any asset. But why only NIGHT? Possibly because NIGHT was the only asset with enough liquidity to cover the exploit without triggering immediate alarms. - Malicious validation: The bridge relied on a centralized validator to approve cross-chain messages. If that validator was compromised, the attacker could forge withdrawal proofs.
Code excerpt (hypothetical, based on common patterns): ```solidity function withdraw(address token, uint256 amount, bytes memory proof) external { require(validators[msg.sender], "Not a validator"); - wNIGHT on BNB Chain: Exit immediately if you can swap to stablecoins. Liquidity may dry up within hours. - Wanchain bridge: Do not use any Wanchain bridge for the foreseeable future—not just the Cardano one. The trust fabric is torn. - Alternative bridges: Move to LayerZero (Stargate) or Wormhole for Cardano–BNB needs. Yes, Wormhole was hacked for $325M in 2022, but it has a compensation mechanism and decentralized validator set. That’s a better bet than a black box.
Professional warning: If you are a yield farmer who parked NIGHT in a lending protocol on BNB Chain, check your health factor now. The collateral value just dropped 27%. Liquidations may cascade.
Panic sells, liquidity buys. But only after the second wave of selling passes. Wait until the attacker dumps the remaining 2.25 billion, then you can assess if any value remains.