515M NIGHT drained from Cardano bridge; ADA jumps 8%

On July 20 an attacker drained roughly 515 million NIGHT tokens from a Cardano-side lock address used by Wanchain’s Cardano-to-BNB bridge. The tokens were worth about $9 million to $10 million at the time of the sell-off, and NIGHT fell more than 30% to a low near $0.015 before partially recovering.

Wanchain suspended the affected bridge and opened an investigation after funds were moved out of the bridge treasury. Major exchanges including Binance, Kraken, KuCoin, Bybit, OKX, Gate and MEXC froze or restricted accounts, blacklisted attacker-linked wallets and suspended NIGHT deposits or withdrawals where necessary to limit further movement of the assets.

Blockchain security firm BlockSec reported preliminary analysis pointing to a possible issue in the TreasuryCheck validator’s signed-message encoding that could have allowed a previously valid signature to be reused with different transaction data. BlockSec described the findings as preliminary while investigations continue. The Midnight Foundation said the breach was confined to third-party bridge infrastructure and did not affect Midnight’s protocol, validator network, consensus system or the NIGHT smart contract running on Cardano.

Cardano founder Charles Hoskinson convened a response team that included Midnight, Input Output, Intersect and other ecosystem participants to monitor the incident. He called for audits to establish “ground truth” and responsibility. On bridge risks he stated, “Bridges are the most vulnerable of all of these attacks in the cryptocurrency space,” and added, “Being 90% resistant to a deadly disease doesn’t mean you’re immune to a deadly disease. It just means more often than not you’re unlikely to catch it.”

After the initial crash, NIGHT recovered to about $0.022, roughly 30% above the low and up about 19% over 24 hours. Hundreds of millions of tokens left the bridge treasury before exchange blocks narrowed the attacker’s access to major centralized venues.

Earlier in late June Midnight temporarily paused Glacier Drop redemptions after a separate incident affected some Cardano wallets; those redemptions resumed on July 9 after Midnight confirmed its own systems were not exposed. Midnight and other parties have characterized the Wanchain exploit as a failure of external bridge infrastructure rather than a flaw in Cardano’s consensus protocol.

The van Rossem hard fork moved Cardano to protocol version 11, expanding Plutus smart-contract capabilities and tightening ledger rules. ADA traded around $0.175 to $0.177 after the upgrade, up about 8% and bringing $0.20 back into view. Broader market strength, including Bitcoin trading above $66,000, supported the price gains. Blockchain analytics firm Santiment reported Cardano’s 30-day market-value-to-realized-value ratio moved above zero, indicating that buyers over the past month were, on average, in unrealized profit.

Participants discussed technical approaches to reduce bridge risk, including recursive or folded zero-knowledge proofs to limit reliance on external verification, trusted execution environments and multisignature controls. Midnight highlighted an identity and selective-disclosure initiative called Midnight Passport that aims to help establish wallet ownership without exposing unnecessary personal data, which proponents say could aid fund recovery and insurance processes after exploits.

Wanchain, Midnight, exchanges and security teams continue investigations. Audits and further technical analysis are expected to clarify the cause of the exploit and whether fixes are needed to bridge infrastructure or validator encoding.