A cross-chain bridge protocol called Wanchain fell victim to a $10 million theft on July 20, 2026, exposing a critical vulnerability in how blockchain networks communicate with each other. The attack stemmed from a flaw in how the protocol validated transactions, allowing an attacker to forge signatures and drain approximately 515.2 million NIGHT tokens. Rather than pursue legal action, Wanchain publicly offered the hacker a white-hat bounty, keeping 10% of the stolen funds if they returned the remaining 90% by August 6, 2026. This pragmatic approach highlights both the desperation and the systemic failures plaguing cross-chain security.

What Went Wrong in the Wanchain Bridge Exploit?

The root cause of the Wanchain breach was surprisingly straightforward, yet devastating. Security firm BlockSec identified the vulnerability as a non-injective signed-message encoding flaw in the TreasuryCheck validator. In plain terms, the protocol concatenated variable-length data fields without proper delimiters, meaning the attacker could reuse signatures across different transactions. This is a recurring weakness in cross-chain infrastructure, where bridges must validate transactions across multiple blockchains simultaneously.

The attack unfolded rapidly. The attacker executed four transactions within an eight-minute window, quickly moving the stolen NIGHT tokens into a primary Cardano wallet and liquidating roughly 90% of the haul through decentralized exchanges and DeFi protocols on the network. At the time of the exploit, NIGHT was trading around $0.01950 per token. The speed and efficiency of the attack underscore how quickly attackers can move stolen assets once they gain access to a bridge.

How Are Bridge Exploits Becoming More Common Across Crypto?

The Wanchain incident is not an isolated event. According to on-chain security platform Blockaid, the first half of 2026 was the most exploited period in crypto history. Total losses from security incidents surpassed $1.1 billion across 212 verified attacks. More alarming, the number of high-threshold exploits in the first six months of 2026 was 3.4 times higher than the entire year of 2025.

However, the overall dollar losses were lower than the same period last year, largely because there was no single catastrophic breach on the scale of the $1.5 billion Bybit hack. Instead, losses were concentrated among four major incidents. The four largest attacks dominated the damage, accounting for approximately $707 million, or 64% of all losses during the period.

• KelpDAO: Suffered a $292 million exploit, making it one of the largest attacks in the first half of 2026.
• Drift Protocol: Lost $285 million in a separate attack, highlighting vulnerabilities in decentralized derivatives platforms.
• Resolv and CowSwap: Combined with the above two incidents to account for the majority of first-half losses.
• North Korean Attribution: Blockaid linked the TraderTraitor subgroup of the Lazarus Group to the KelpDAO, Drift Protocol, and Humanity Protocol exploits, which together accounted for roughly $609 million, or about 55% of total losses.

Why Do White-Hat Bounty Offers Create Controversy?

Wanchain's decision to offer the hacker a 10% bounty for returning 90% of the stolen funds is pragmatic but contentious. The protocol pledged not to pursue civil claims if the offer is accepted, and it has engaged blockchain analytics firms and flagged relevant addresses with exchanges for monitoring. The hacker can return funds to a specified Cardano or Ethereum address, or communicate via email at whitehat@wanchain.org.

While such agreements can improve the chances of recovering stolen assets, they have sparked debate over whether bounty offers incentivize attackers to negotiate after an exploit. Some argue that offering a financial reward for returning stolen funds essentially legitimizes the theft, potentially encouraging future attackers to view hacks as negotiable transactions rather than crimes. Others contend that recovering even 90% of stolen assets is preferable to losing everything, especially when law enforcement options are limited in the decentralized finance space.

Steps to Strengthen Cross-Chain Security

The Wanchain incident underscores the continuing security challenges facing cross-chain infrastructure. Bridge vulnerabilities have remained one of the largest sources of losses in the digital asset industry, exposing users and liquidity providers to significant risks. As investigations continue, the outcome of Wanchain's offer may influence how future bridge exploits are handled, but it also highlights the need for stronger security measures across cross-chain protocols.

• Rigorous Code Review: Cross-chain protocols must implement comprehensive smart contract audits before deployment, with particular attention to signature validation and message encoding mechanisms.
• Delimiter Implementation: Developers should use explicit delimiters when concatenating variable-length fields, preventing signature reuse attacks that exploit ambiguous message boundaries.
• Monitoring and Response: Protocols should establish relationships with blockchain analytics firms and exchanges to flag suspicious wallet activity and enable rapid response to exploits.
• Transparent Communication: When incidents occur, clear communication with users and the broader community, as Wanchain demonstrated, can help maintain trust and coordinate recovery efforts.

The Wanchain case reveals that cross-chain security is not merely a technical problem but a systemic one. As more users and assets flow across blockchain bridges, the incentives for attackers grow, and the consequences of failure become more severe. The 3.4x increase in high-threshold exploits in 2026 compared to 2025 suggests that the crypto industry is in a critical period where security practices must evolve faster than attack sophistication.