The cross-chain bridge protocol set an August 6, 2026 deadline after about 515.2 million NIGHT tokens, worth around $10 million, were taken in the July 20 exploit.
Wanchain has offered the attacker behind its Cardano bridge exploit a white-hat deal that would let the perpetrator keep 10% of the stolen NIGHT tokens if the remaining 90% is returned by August 6, 2026, at 12:00 UTC. The exploit on July 20, 2026 led to the theft of about 515.2 million NIGHT, valued at around $10 million, and the protocol said it would not pursue civil claims if the offer is accepted. The cross-chain bridge protocol said the stolen funds can be sent back to a specified Cardano address or to an Ethereum address listed in its statement. It also said the attacker can respond through an on-chain message from the exploit wallet or by emailing whitehat@wanchain.org. Blockchain analytics firms and exchanges are monitoring flagged wallets as recovery efforts continue. BlockSec said its Phalcon monitoring system first flagged the exploit on July 21. Analysts traced the attack to a non-injective signed-message encoding flaw in the TreasuryCheck validator, where raw concatenation of variable-length fields without proper delimiters allowed signature reuse. The attacker then moved the NIGHT tokens to a primary Cardano wallet and liquidated roughly 90% of the haul through decentralized exchanges and DeFi (blockchain-based financial apps) protocols on the network. NIGHT was trading around $0.01950 at the time. Wanchain said the Cardano-BNB Chain bridge had been temporarily disabled and that the incident had its full attention. The case lands amid a broader surge in crypto security breaches. Blockaid, an on-chain security platform, said the first half of 2026 saw more than $1.1 billion in losses across 212 verified attacks, with high-threshold exploits running 3.4 times the full-year 2025 count. The episode also renews debate over white-hat settlements, which can aid recovery but may also encourage post-hack bargaining.