$9 Million Heist on Cardano Bridge: Privacy-Focused Altcoin Price Plummets

Approximately 515 million NIGHT tokens, worth about $9 million, were stolen as a result of a security breach on the Wanchain network’s Cardano bridge.

The cryptocurrency world was shaken by news of a major cyberattack targeting the bridge protocol between Wanchain and Cardano. According to data shared by security analysis firm BlockSec, attackers targeted the bridge treasury and successfully transferred a massive amount of assets to their own wallets. At the center of the incident is NIGHT, the native token of the privacy-focused Midnight project developed by Input Output (IO), the company behind Cardano.

Following news of the attack, the NIGHT price experienced a sharp decline. Losing more than 30% of its value during the day, the cryptocurrency dropped to the $0.016 level, hitting an all-time low. The withdrawal of a total of 515 million NIGHT tokens from circulation has put serious pressure on the project’s market credibility.

Technical Reason for the Wanchain Bridge Attack

Technical investigations conducted by the BlockSec Phalcon team revealed that the attack stemmed from a validation error on the bridge. A serious vulnerability was detected in the message encoding method within the validator system called TreasuryCheck. This error caused different data inputs to produce the same digital hash value, allowing attackers to perform unauthorized transactions using the “signature reuse” method.

According to the technical data in the visual, the system was concatenating 14 different variable-length fields without using any delimiters or length indicators. This situation allowed malicious actors to generate forged signatures that the system would accept as valid. While the current market value of the stolen assets is calculated at approximately $9 million, developer teams are continuing their work to close the vulnerability and protect the ecosystem.