515M NIGHT Moved: What We Know About the Wanchain Bridge Incident
Episode by Peter Bui on July 24th, 2026
A developing Wanchain bridge incident has put bridged NIGHT under heavy pressure, with early analysis pointing to 515 million NIGHT tokens moving into the Cardano ecosystem and being sold across decentralised exchanges. The situation is still unfolding, but the main distinction matters: the available information points to bridge operations, not a compromise of Midnight itself or Cardano-side Midnight infrastructure.
In this episode, Peter walks through the early reports, the visible on-chain activity, and the warnings from the Midnight Foundation. It is a useful reminder that bridges remain one of the highest-risk parts of crypto, especially when large amounts of wrapped or bridged assets depend on infrastructure outside the base chain.
What Appears To Have Happened
The incident centres on the Wanchain Cardano-to-BNB bridge and bridged NIGHT. According to the episode, the first red flag was abnormal movement from the Binance Smart Chain side into Cardano, followed by rapid selling of NIGHT across Cardano DEXs. Peter describes this as a developing story rather than a final confirmed exploit, but the scale of the movement made it urgent.
The reported figure is significant: 515 million NIGHT tokens, described in the episode as around 2% of supply, moved from a two-year-old contract. From there, the activity split across wallets, DEXs, and exit routes. Peter points viewers to the initial analysis from CWPaul and the UTXOMaestro analysis for the evolving wallet flow.
Midnight And Cardano Are Not The Same Attack Surface
One of the most important points in the episode is the separation between the bridge incident and the Midnight network itself. The official Midnight Foundation statement says the reports appear to relate to cross-chain bridge operations, not the Midnight network. Peter also stresses that there is no indication from the available information that retail wallets, Cardano itself, or Midnight smart contracts on Cardano were directly compromised.
That difference can easily get lost when a token price is falling and social channels are moving quickly. A bridge can introduce a separate trust and operational layer around an asset. If that bridge layer fails, the impact can be severe for the bridged asset without meaning the underlying network has been hacked.
Following The On-Chain Trail
The episode follows several visible pieces of on-chain activity. Peter describes one wallet selling heavily across Cardano DEXs, another wallet holding a large balance, and attempts to exit through assets such as USDCx. Viewers can follow some of the trading and wallet activity through the provided FetchSwap market view and portfolio view.
One notable part of the analysis involves NIGHT being supplied into Liqwid Finance as collateral to borrow ADA. Peter frames this as a sign that whoever controlled the wallet understood the Cardano DeFi ecosystem well enough to use multiple exit paths rather than simply dumping in one place.
DEX And Bridge Responses
As the activity developed, Peter noted that some ecosystem participants appeared to be limiting features or watching liquidity routes closely. He mentioned Minswap pausing zap-in features for NIGHT pools, and the episode also discusses exit routes through DEXs, aggregators, and centralised exchanges.
The point is not that every response solves the problem immediately. In a fast-moving incident, reducing obvious exit paths and slowing automated liquidity actions can still matter. It gives teams and users more time to understand what is happening and helps reduce confusion while official updates are still pending.
Why Bridge Risk Keeps Coming Back
Peter connects this incident to a broader security lesson: bridges have repeatedly been one of the most vulnerable parts of the crypto stack. Cardano’s long-running emphasis on formal methods, peer review, and conservative engineering does not eliminate all risk across connected infrastructure, but it does reduce the set of attack vectors in the core system.
That distinction matters for users. A bridge can make assets more useful across ecosystems, but it also creates an additional layer that needs to be trusted, monitored, and maintained. When something appears to go wrong at that layer, users should avoid rushing into trades based purely on a falling price and should instead wait for confirmed updates.
What To Watch Next
This is still a developing story. Peter recommends following official updates from the Midnight Foundation and Wanchain, while staying alert for phishing and impersonation scams. As with any active incident, the first few hours can include incomplete information, speculation, and opportunistic scams.
The practical takeaway is simple: separate the confirmed facts from the assumptions, understand which part of the stack is affected, and be careful with any asset or protocol directly exposed to the incident until the relevant teams provide clearer information.
Key Takeaways
- The incident appears to involve the Wanchain Cardano-to-BNB bridge and bridged NIGHT, not the Midnight network itself.
- Early analysis points to 515 million NIGHT tokens moving from a two-year-old contract, representing about 2% of supply.
- One wallet reportedly sold hundreds of millions of NIGHT across Cardano DEXs, while another wallet remained active with a large balance.
- Some DEX and bridge operators responded by pausing features or limiting exit paths while the situation developed.
- Follow official updates, remain alert to phishing or impersonation scams, and avoid treating the price drop as a simple dip-buying opportunity.
- The episode reinforces why bridge infrastructure is a high-risk part of crypto and why formal methods and peer review matter.
Disclaimer: This content is for educational purposes only. Nothing in this article constitutes financial advice. Always do your own research.
Text Transcript
And we noticed an anomaly from the Binance Smart Chain side to the Cardano side where it associated with Binance and the Wanchain bridge was being rapidly dumped as quickly as possible on the DEXs of Cardano. So after a brief investigation, it became clear that it looked like the Wanchain bridge had become compromised. Midnight and the smart contract for the Midnight token on the Cardano network are operating just fine, running 24-7, no incidents or issues. Glacier drop is continuing and none of Midnight’s infrastructure has been hacked and nothing on the Cardano side related to Midnight has been hacked.
It appears that this is completely localized to Wanchain’s infrastructure. This requires more vigilance. Now from Cardano’s standpoint, we predicted that these things were going to happen. Formal methods, peer review, these things are not buzzwords.
They considerably reduce the set of attack vectors that are possible in an ecosystem. Bridges are the most vulnerable of all of these attacks in the cryptocurrency space. Guys, we’ve got some absolutely crazy news at the moment. I woke up to this headline here and this is the Night Token dropping up to 50% in 24 hours.
Not even 24 hours, about a 12-hour period. It looks like there had been an exploit on a smart contract that was attached to Wanchain and from there, 515 million Night Tokens had been moved to the Cardano ecosystem and this particular attacker, exploiter, is liquidating all those assets at the moment and it’s still ongoing at the moment. So we really need to make sure we follow the updates here from the Midnight Foundation to find out what’s going on. Now it’s very important to note that this isn’t a direct exploit on the Cardano ecosystem or on the Midnight network itself.
So it doesn’t appear to be an exploit from any of the smart contracts there and it may very well be on the Wanchain side itself, which is really, really concerning. But we’ll get more information about that as various teams investigate what’s going on and action is being taken. So this is the announcement from the Midnight Foundation. We are aware of reports concerning an incident involving the Wanchain Cardano to BNB bridge affecting Bridge Night.
Based on information currently available, it appears to relate to cross-train bridge operations and not the Midnight network itself. We are actively monitoring the situation and working with relevant partners to establish the facts. We encourage the community to rely only on official updates and to remain vigilant to phishing attempts and impersonation scams while investigations are ongoing. So the good thing here, it doesn’t look like it is attacking people’s wallets.
So retail isn’t being affected here, but it’s affecting the smart contract that is holding up the BNB bridge. So I’m sure if we look at the bridge assets over on BNB as well, that particular side of things would be drastically affected. So any of those WRAP tokens over there, they’re pretty much worthless at the moment. But let’s have a look at what’s going on.
So this is what Paul put out. We noticed the attack starting in UTC time at 2.46pm UTC. A two-year-old contract with $515 million NIGHT, 2% of the supply, had been withdrawn and moved over to the Kidana ecosystem. Other tokens within this contract, MINTH, XER, and WMT were left untouched.
And since then, the WalletOne has sold over $288 million across various DEXs, pushing the price down 50%. Another wallet with $200 million is still active and barely has sold anything yet. These are the wallet addresses. I’ll put the links down below for you guys, but you can watch the activity and what’s happening on Fetch itself.
You can see the price of NIGHT moving. It’s a, yeah, you can see that massive drop there. And people are actually buying into the NIGHT tokens now, trying to buy that dip. But I do have to warn you guys, there is still more, more of the potential of NIGHT being sold off.
So please be aware of that. Now this here is an early analysis of what is actually happening at the moment. And I thought this was pretty good to look into here. This is from UTXO Maestro.
And it pulls up, put together this diagram here that shows where all the NIGHT tokens is moving at the moment, which is interesting. So we’ve got that $515 million from the one-chain side of things, moving over to an operational wallet within the Kidana ecosystem. So this is the ops wallet that moved into, and then split off to the secondary wallet here. So some of that $515 went to this wallet here, which had 200 million NIGHT tokens.
WalletOne continued to sell off as much of its NIGHT tokens as possible. We got 87 million of NIGHT that went to USDCX, and they’re trying to exit out of the ecosystem there. So from what I’ve heard and what I’ve read, it looked like the USDCX bridge had been closed down too. So that might be a good thing to stop that exit ramp.
We also have the various DEXs out there, seeing that activity go up. We’re seeing NIGHT being sold off for ADA at the moment. And we’re also seeing that being sent out to various centralized exchanges. So we’ve got 39 deposits to centralized exchange wallets.
It looks like $500K went to Binance as well. And they’re trying to sell out at that point there. And we’ll see what happens with that. But the interesting thing here is what is happening with WalletTwo.
And this is why I said, this is definitely someone within the Kidana ecosystem because they know what’s going on here and how things work. So WalletTwo was not just dumping. It put 68 million NIGHT tokens into Liquid. Liquid Finance is borrowing a lending protocol on Kidana.
So they used that NIGHT tokens to borrow an extra 4.36 million ADA against it and then sent that 4.36 million ADA back off to WalletOne, where it continued to find ways to exit out the ecosystem. So that’s crazy. That’s insane. Nice to see that 68 million NIGHT tokens being locked into Liquid Finance, but that’s not going to be repaid.
That’s going to be defaulted on. You can follow all the activity here, all the links to the Kidana scan address, on-chain address activity. I’ll put in the links down below for you guys. Crazy stuff, guys.
But like I said, we need to monitor and watch what’s going on here. So make sure you follow the Midnight Foundation for updates and accurate information. Various DEXs are encouraging that as well. And where it’s also good to see that DEXs like Minswap are pausing some of their features such as the ZAP-IN feature for the NIGHT ADA pools and the NIGHT USDC pools.
That might make it a little bit harder for the attacker to exit out of these particular pools and Liquidities and whatnot. But we’re still seeing, you know, DEX aggregators pass through and sell the assets. So we’re going to see a lot more activity, guys. We can see here, this is tracking one of the attacker’s wallets here, and they’re constantly selling a lot of the assets through here in 3 million batches.
So every 10 or so minutes, they’ll sell 3 million NIGHT tokens for around 260,000 ADA. You can see lots of failed transactions here that didn’t quite make it, maybe slippage or whatever it is. But if you are buying NIGHT tokens, be aware of what’s actually happening here. There’s still more activity going on.
We haven’t heard from the 1Chain team yet. We haven’t seen an official announcement that there’s been an exploit. All of this hasn’t been confirmed yet. We don’t know exactly what’s going on.
We don’t know if it is the 1Chain side of things or someone gained access to the wallet and is simply just exiting the ecosystem and selling all the assets. So we don’t know exactly what’s going on here, but it doesn’t look good overall. So that’s all I know at the moment, guys. It’s still a developing story.
We will hear more. I’ll keep you guys up to date with what’s happening here, but make sure you do follow the Midnight Foundation. It’s good to know that it isn’t specifically a Cardano vulnerability or a Midnight vulnerability, may entirely rest on the 1Chain side of things, which is really unfortunate because 1Chain has been around for a very long time with a lot of good uptime uninterrupted for 8 years with no exploits supporting 48Chains. They’ve supported the Cardano ecosystem for a long time and I really hope this isn’t the case, but we’ll find out more as time progresses and various teams work out what exactly is going on.
Not good, guys. On the upside, though, 1Chain activity is up. Taxes are reaping rewards in regards to fees, but, you know, it’s definitely not the way you want to see things. Anyway, guys, try and stay positive out there.
I know the crypto space is kind of wild at the moment. Anyway, guys, if you learned something from this video, make sure you hit that thumbs up, like, subscribe, notification bell. If you want to be kept up to date with everything, make sure you hit that subscribe button. Oh, God, I’ve got YouTube memberships down below.
I’ve got buy me a coffee links, great way to support the channel. And like always, guys, try and stay positive. I’ll see you in the next video.
Comments