515M NIGHT bridge exploit rocks Cardano but ADA jumps 8% anyway after landmark hard fork

A notable development has hit the crypto markets. A major exploit involving a bridge connected to the Cardano ecosystem sent Midnight’s NIGHT token to an all-time low on July 20 after an attacker drained roughly 515 million tokens from infrastructure operated by Wanchain. The tokens were removed from a Cardano-side lock address backing NIGHT bridged to BNB Chain, leaving only a fraction of the bridge’s previous reserves. NIGHT fell more than 30% during the fallout and touched a record low near $0.

At prices around the time of the sell-off, the stolen assets were worth roughly $9 million to $10 million. Wanchain suspended the affected Cardano-to-BNB Chain bridge and began investigating the incident. What caused Cardano's Midnight bridge exploit?

Market Dynamics

Blockchain security firm BlockSec said its preliminary analysis pointed to a possible problem in the TreasuryCheck validator’s signed-message encoding that could have allowed a previously valid signature to be reused with different transaction data. However, the firm stressed that the investigation remained preliminary. The Midnight Foundation said the breach was confined to the third-party bridge infrastructure and did not disrupt Midnight’s protocol, validator network, consensus system or core infrastructure.

The NIGHT smart contract operating on Cardano also continued functioning. Midnight later said Binance, Kraken, KuCoin, Bybit, OKX, Gate and MEXC had joined efforts to limit movement of the stolen assets. Measures included freezing or restricting accounts and addresses associated with the incident, blacklisting attacker-linked wallets and suspending NIGHT deposits and withdrawals where necessary.

The response has narrowed the attacker’s access to major centralized trading venues after hundreds of millions of NIGHT moved out of the bridge treasury. Cardano founder Charles Hoskinson said organizations across the ecosystem formed a “war room” to monitor the situation as it unfolded, bringing together Midnight, Input Output, Intersect and other groups involved in the response. Hoskinson said audits would be required to establish “ground truth” around the failure and responsibility for the incident.

Market Impact

Hoskinson says bridge risks remain beyond Cardano’s core defenses The attack has shifted attention toward a part of the crypto stack that Hoskinson says remains particularly difficult to secure even when the underlying blockchain continues operating normally. “Bridges are the most vulnerable of all of these attacks in the cryptocurrency space,” Hoskinson said, arguing that cross-chain systems typically depend on sources of verification or trust outside the networks they connect. Unlike transactions that remain within a single blockchain, bridges must coordinate activity across separate networks.

That can require external relayers, validators, multisignature arrangements, or smart contracts that determine whether assets should be released on the destination chain. As a result, these platforms have become targets for malicious attackers who have stolen more than $2 billion in crypto from these infrastructures. Meanwhile, Hoskinson used the incident to defend Cardano’s longstanding emphasis on formal methods, peer review and protocol design, which he said reduces the number of potential attack vectors available to malicious actors.

However, he stopped short of describing those practices as complete protection against attackers. Instead, Hoskinson compared the approach to being 90% resistant to a deadly disease: the likelihood of harm can be substantially reduced while the possibility of failure remains. He said: “Being 90% resistant to a deadly disease doesn’t mean you’re immune to a deadly disease.

This shift continues to shape the digital-asset landscape, with analysts examining its near-term effects.