Key Takeaways

  • Midnight Protocol Uncompromised: The security breach occurred strictly within third-party cross-chain bridge infrastructure operated by Wanchain on the Cardano-to-BNB route. The core Midnight blockchain layer remains secure.

  • Massive Token Outflow: Approximately 515.2 Million $NIGHT tokens were exploited from the bridge and funneled into a primary wallet address within an eight-minute window.

  • Aggressive Market Liquidation: The bad actor quickly liquidated around 90% of the compromised assets via DEX swaps and DeFi leverage protocols.

  • Funds Traced to CEXs: Blockchain intelligence firm UTxOMaestro mapped the full wallet cluster, tracking proceeds into fresh vault addresses and 39 exchange-style deposit destinations.

What Happened?

Earlier today, on-chain analysts flagged suspicious activity surrounding Wanchain’s cross-chain bridge infrastructure connecting the Cardano mainnet to BNB Chain. A security exploit allowed an attacker to drain 515.206 million $NIGHT tokens from the bridge in four rapid transactions spanning just eight minutes.

The official Midnight Network team clarified that this incident is strictly an exploit of third-party bridging operations and does not reflect a flaw or vulnerability in the underlying Midnight protocol itself. However, the sheer volume of tokens moved and subsequently liquidated triggered significant short-term price volatility across decentralized exchanges (DEXs).

Detailed On-Chain Trace: How the Funds Moved

Blockchain analytics group UTxOMaestro mapped out the step-by-step flow of the compromised tokens across the Cardano network:

[ Wanchain Bridge Contract ]
            │
            ▼ (515.2M $NIGHT in 8 mins)
       [ Wallet 1 (W1) ] ──► (Sells ~217.7M $NIGHT for 24.02M ADA)
            │            ──► (Sells ~87.88M $NIGHT for 1.44M USDCx)
            │
            ├───────────────────────┐
            ▼ (200.06M $NIGHT)      ▼ (4.36M ADA)
       [ Wallet 2 (W2) ] ──────► [ Wallet 1 (W1) ]
            │
            ▼ (68.27M $NIGHT to Liqwid)
    (Borrows 4.364M ADA)
            │
            ▼
       [ Exit Routes ] ──► Fresh Vault (W3): 23.424M ADA
                       ──► 39 CEX Deposit Addresses: 3.75M ADA (Incl. Binance)

Phase 1: The Initial Drain to Wallet 1 (W1)

The Wanchain bridge address on Cardano released four massive chunks of $NIGHT tokens directly into a single receiving wallet (W1):

  • Chunk 1: 203.0M $NIGHT

  • Chunk 2: 129.6M $NIGHT

  • Chunk 3: 120.4M $NIGHT

  • Chunk 4: 62.1M $NIGHT

  • Total: 515.206M $NIGHT

Phase 2: Instant DEX Liquidations

Almost immediately after receiving the tokens, W1 initiated aggressive market sells across decentralized trading venues, securing:

  • 217.7M $NIGHT swapped for 24.02M ADA

  • 87.88M $NIGHT swapped for 1.44M USDCx

Phase 3: Coordinated Cluster Operation (W2 & Liqwid Protocol)

To maximize yield and split up market footprint, W1 funded a secondary address (W2) with 1,000 ADA for gas and transferred 200.06M $NIGHT.

W2 was then utilized to leverage the tokens on money markets rather than dumping them outright:

  • W2 deposited 68.27M $NIGHT as collateral into the Liqwid Protocol.

  • W2 borrowed 4.364M ADA against that collateral.

  • W2 immediately transferred 4.36M ADA back to W1, establishing a clear, coordinated wallet cluster.

Phase 4: The Capital Exit Flow

Once the tokens were swapped or leveraged into stable assets (ADA and USDCx), the attacker moved to finalize the extraction:

  • Fresh Vault Address (W3): 23.424M ADA was transferred to a newly generated vault address (addr1qyx99...).

  • Centralized Exchanges: 3.75M ADA was fragmented across 39 exchange-style deposit addresses, including a cluster linked to Binance, indicating an ongoing attempt to cash out to fiat.

Key Addresses Involved

For independent verification on block explorers like Cardanoscan or Cexplorer, here are the main contracts and wallets identified in the flow:

  • Wanchain Bridge Contract (Cardano Side):

    addr1xyw0kswupwx38ljnvq8pwpvae0x69krywdr7cffg3d84ydp9nvv84g58ykxqh90xx6j8ywgjst0dkt430w9lxgdmzncsw5rzpd

  • Primary Exploiter Wallet (W1):

    addr1qysj48kpy8qra2g64scvu79n489qrv2uys5ggsrun29v5f5udqxfpr7x0pqfl6khjwv6vm0k8s3spn6h0zfrwszfqgcqeld8kj

  • Secondary Cluster Wallet (W2):

    addr1qx7haxyr5qdwcpkvdjmrjnk8wzrsyh7usaajpt3crmted5nkw3n3ner7p6vjudr5urnxywhx0zj5e487w5d3ry4s6nsq2k7aq5

  • Vault Storage Wallet (W3):

    addr1qyx992x3khmvc0leu8qge5gs4yys53eecarkx29cyekqfzscummv9adtkfu3qsssupfzxgv5vldajdnuj8926xa8kn0q3mhtym

Credit to: https://x.com/UTxOMaestro for deep diving this information