A major exploit involving a bridge connected to the Cardano ecosystem sent Midnight’s NIGHT token to an all-time low on July 20 after an attacker drained roughly 515 million tokens from infrastructure operated by Wanchain.
The tokens were removed from a Cardano-side lock address backing NIGHT bridged to BNB Chain, leaving only a fraction of the bridge’s previous reserves.
NIGHT fell more than 30% during the fallout and touched a record low near $0.015. At prices around the time of the sell-off, the stolen assets were worth roughly $9 million to $10 million.
Wanchain suspended the affected Cardano-to-BNB Chain bridge and began investigating the incident.
What caused Cardano’s Midnight bridge exploit?
Blockchain security firm BlockSec said its preliminary analysis pointed to a possible problem in the TreasuryCheck validator’s signed-message encoding that could have allowed a previously valid signature to be reused with different transaction data.
However, the firm stressed that the investigation remained preliminary.
The Midnight Foundation said the breach was confined to the third-party bridge infrastructure and did not disrupt Midnight’s protocol, validator network, consensus system or core infrastructure. The NIGHT smart contract operating on Cardano also continued functioning.
Midnight later said Binance, Kraken, KuCoin, Bybit, OKX, Gate and MEXC had joined efforts to limit movement of the stolen assets. Measures included freezing or restricting accounts and addresses associated with the incident, blacklisting attacker-linked wallets and suspending NIGHT deposits and withdrawals where necessary.
The response has narrowed the attacker’s access to major centralized trading venues after hundreds of millions of NIGHT moved out of the bridge treasury.
Cardano founder Charles Hoskinson said organizations across the ecosystem formed a “war room” to monitor the situation as it unfolded, bringing together Midnight, Input Output, Intersect and other groups involved in the response.
Hoskinson said audits would be required to establish “ground truth” around the failure and responsibility for the incident.
Hoskinson says bridge risks remain beyond Cardano’s core defenses
The attack has shifted attention toward a part of the crypto stack that Hoskinson says remains particularly difficult to secure even when the underlying blockchain continues operating normally.
“Bridges are the most vulnerable of all of these attacks in the cryptocurrency space,” Hoskinson said, arguing that cross-chain systems typically depend on sources of verification or trust outside the networks they connect.
Unlike transactions that remain within a single blockchain, bridges must coordinate activity across separate networks. That can require external relayers, validators, multisignature arrangements, or smart contracts that determine whether assets should be released on the destination chain.
As a result, these platforms have become targets for malicious attackers who have stolen more than $2 billion in crypto from these infrastructures.
Meanwhile, Hoskinson used the incident to defend Cardano’s longstanding emphasis on formal methods, peer review and protocol design, which he said reduces the number of potential attack vectors available to malicious actors.
However, he stopped short of describing those practices as complete protection against attackers.
Instead, Hoskinson compared the approach to being 90% resistant to a deadly disease: the likelihood of harm can be substantially reduced while the possibility of failure remains. He said:
“Being 90% resistant to a deadly disease doesn’t mean you’re immune to a deadly disease. It just means more often than not you’re unlikely to catch it.”
That distinction has become increasingly relevant as the Cardano ecosystem expands beyond the security boundaries of its base network.
Midnight temporarily suspended Glacier Drop redemptions in late June after a separate security incident affected some Cardano wallets associated with SecondFi. The foundation resumed redemptions on July 9 after concluding that its own redemption infrastructure and systems were not exposed.
The Wanchain exploit presents a different vulnerability but again shows how losses involving services built around Cardano can emerge without a failure in Cardano’s consensus protocol.
Hoskinson said the answer requires additional layers of protection rather than relying solely on the security properties of an underlying blockchain.
He pointed to future bridge designs incorporating recursive or folded zero-knowledge proofs, which could reduce dependence on external sources of validation.
Those systems could be combined with measures such as trusted execution environments and multisignature controls to create additional barriers against unauthorized transfers.
He also highlighted Midnight Passport, an identity and selective-disclosure system that could allow users to establish ownership of wallets without publicly exposing all of their personal information.
That capability could become useful after hacks in which recovered funds must eventually be returned to legitimate owners. Crypto recovery processes can become difficult when users have lost credentials or when ownership cannot easily be established without sacrificing privacy.
Hoskinson said stronger identity tools could eventually support insurance products covering losses from security failures. Users who can establish ownership and meet defined security standards could purchase coverage that provides restitution when an exploit occurs.
Those ideas remain part of Midnight’s longer-term development rather than an immediate remedy for the Wanchain losses.
ADA defies NIGHT sell-off as $0.20 returns to view
Despite the security scare, ADA has experienced a sharply different outcome as its value climbed nearly 8%.
Data from CryptoSlate showed that ADA traded around $0.175 Tuesday after reaching roughly $0.177, extending its gain over the past week to about 11%.
The move has brought $0.20 back into range after the token spent much of the recent downturn below that threshold.
The divergence suggests traders have so far limited the market consequences of the Wanchain exploit to the bridge and NIGHT rather than applying the same discount to ADA.
ADA has also benefited from a wider cryptocurrency recovery. Bitcoin moved back above $66,000 as several major digital assets advanced, helping lift sentiment after weeks of weaker prices.
Blockchain analysis firm Santiment noted that this rebound has pushed Cardano’s 30-day market-value-to-realized-value ratio back above zero, alongside Bitcoin, ETH and XRP.
The metric measures whether investors who acquired an asset over a specified period are sitting on an average profit or loss. A positive 30-day reading means the typical buyer from the previous month has returned to unrealized profit.
For ADA, the shift represents a marked change from June, when Santiment data showed its 30-day MVRV around negative 18%, placing recent buyers substantially underwater.
The improvement also creates a potential source of selling pressure. Holders who bought during the decline can now exit at a profit, giving them more incentive to take gains if the recovery loses momentum.
Santiment has said the latest readings remain below levels associated with an overheated market, though the move above neutral reduces the conditions that previously discouraged short-term selling.
The rally also comes three days after Cardano enacted the van Rossem hard fork, moving the network to protocol version 11.
The upgrade expanded Plutus smart-contract functionality and tightened several ledger rules while keeping the blockchain within the Conway era. It was also approved through Cardano’s on-chain governance process involving DReps, stake pool operators and the Constitutional Committee.
That leaves ADA approaching $0.20 with several forces moving at once: a broader crypto rebound, recent protocol progress and a market that has so far separated the Wanchain breach from Cardano’s underlying network, alongside a growing incentive for recently profitable holders to sell.
As of press time, NIGHT has recovered roughly 30% to $0.022, up 19% over 24 hours.
