Cardano Bridge Exploit Drains 515 Million NIGHT Tokens

Cardano News

A security breach on a Cardano cross-chain bridge drained roughly 515 million Midnight (NIGHT) tokens, sending the privacy network's token to an all-time low near $0.01524. On-chain data shows the attacker emptied the Cardano-side lock address on Wanchain between 14:46 and 14:55 UTC, stripping about 97% of the bridge's NIGHT reserves — holdings fell from around 527 million to near 12 million tokens. Only NIGHT left the contract; other bridged assets stayed untouched. Wanchain suspended the bridge to investigate. The wrapped NIGHT circulating on BNB Chain is now largely unbacked, marking one of the year's larger infrastructure exploits tied to Cardano.

The stolen supply moved fast. On-chain data shows the attacker routed funds through freshly created wallets and dumped them on Cardano-based decentralized exchanges, where automated freezes are impossible. Roughly 290 million NIGHT hit those venues, absorbed by automated market maker pools that soaked up the sell pressure and collapsed the price. NIGHT briefly plunged more than 30% intraday, trading around $0.019 at one point — down about 27% on the day. The concentrated dumping overwhelmed thin liquidity, and the token's chart printed a near-vertical drop. Because the exploit sat at the bridge layer, total NIGHT supply was unchanged despite the sharp repricing.

A coordinated exchange response contained the damage. The Midnight Foundation's official update confirmed that seven major venues — Binance, OKX, Kraken, KuCoin, Bybit, Gate, and MEXC — introduced emergency measures to block movement of the stolen funds, valued at roughly $9 million. At the foundation's request, the exchanges blacklisted the attacker's wallets, temporarily froze associated accounts, and suspended NIGHT deposits and withdrawals. That prevented liquidation of the bulk of the 515 million stolen tokens across centralized systems. The attacker still managed to offload around 290 million tokens on-chain before the freezes took hold, but the majority of the altcoin haul was effectively trapped.

The root cause traced to a flawed validator in the bridge code. Analysts examining the exploit found the TreasuryCheck contract verified 14 variable-length data fields concatenated without delimiter characters — a non-injective encoding that let different field combinations produce identical signature bytes. The mechanism enabled a signature-reuse attack: the attacker took a legitimate BNB Chain signature authorizing a transfer of just 3,110 NIGHT and, exploiting the missing field boundaries, replayed it on the Cardano side. The single reused authorization inflated the transaction roughly 65,000 times to 203 million NIGHT in one operation. The vulnerable bridge had been running for about two years before the flaw was weaponized.

Both networks stressed that core systems stayed intact. The Midnight Foundation said its privacy-focused Layer-1 protocol, validator set, consensus, and core infrastructure continued operating normally, and that the underlying Cardano blockchain was unaffected. The incident, the team emphasized, was isolated entirely within the third-party Wanchain cross-chain bridge rather than any systemic failure in either project. NIGHT's token supply and the asset itself remained secure at the protocol level. The distinction matters: the loss represented custody backing for wrapped tokens, not a compromise of the base chains. For holders, the fallout concentrated in the bridge's unbacked wrapped NIGHT rather than native balances.

The breach extended a rough stretch for crypto infrastructure. The Cardano-BNB drain landed shortly after a separate protocol, Allbridge Core, lost about $1.65 million, part of a persistent string of bridge and cross-chain attacks this year. Bridges remain among the most targeted components in the sector because they concentrate custody in single smart contracts, turning one code flaw into a systemic drain. On-chain data shows the attacker's methodical wallet rotation and rapid decentralized-exchange offloading followed a now-familiar laundering playbook. The episode renews scrutiny of validator logic and message-encoding standards across the wrapped-asset bridges that connect Cardano to other chains.

COINOTAG's proprietary 42-indicator composite S/R scoring engine, meanwhile, reads ADA itself as constructive even amid the bridge turmoil, with the token up 7.34% to $0.1754. Our engine rates immediate resistance at $0.1772 a strong 76/100, driven by the confluence of a high-volume node, the EMA 50, and a support-to-resistance flip; the $0.1704 support scores 69/100 on the Fibonacci 0.236 level, a MACD cross, and the 20-period SMA. Derivatives lean long: funding sits at 0.0039%, open interest near $175 million, and the long/short account ratio at 2.36 (about 70% long). With an RSI of 56 and a bullish MACD, a break above $0.2034 opens further upside, while a loss of $0.1704 would invalidate the uptrend. A market-wide Fear & Greed reading of 25 (Extreme Fear) tempers the setup.