Wanchain's Cardano Bridge Breached, 515 Million NIGHT Tokens Stolen on July 21

According to BlockSec, Wanchain's Cardano cross-chain bridge suffered an attack on July 21, with approximately 515 million NIGHT tokens stolen from the bridge vault.

BlockSec's investigation identified the root cause as a signature message encoding vulnerability in the TreasuryCheck validator. The validator constructed signature messages by concatenating 14 variable-length redeem fields without delimiters or length prefixes, allowing different field value combinations to produce identical byte strings and thus reuse the same hash and valid signature. BlockSec verified the vulnerability by decompiling the on-chain Plutus V2 bytecode and decoding the attack transaction.