Wanchain’s Cardano bridge was drained of ~515M NIGHT — roughly $9M — from its treasury, in an exploit flagged by BlockSec’s Phalcon. NIGHT is the token of Midnight, the privacy chain from Cardano’s Input Output.

The root cause was a signature-reuse flaw: the TreasuryCheck validator hashed 14 raw-concatenated fields with no delimiters, so a legit BSC signature authorizing ~3,110 NIGHT was replayed on Cardano to extract 203M NIGHT — a ~65,000x inflation. NIGHT crashed over 30% intraday to a record low near $0.016. Phalcon says CBOR-encoded field boundaries would have blocked this field-splitting signature reuse.