A $13 Million Bridge Forgery, a Repeated Flash-Loan Exploit, and a Critical WordPress Vulnerability | Burn Notice #10
Wanchain's bridge had operated for more than eight years and Allbridge had already patched its attack class once, yet both were compromised through weaknesses their own histories had left unexamined.
In the third week of July 2026, an attacker drained roughly $13 million in NIGHT tokens from Wanchain’s Cardano-to-BNB Chain bridge by exploiting a flaw that let one valid signature be reused to withdraw far more than it should have. The bridge had operated across dozens of chains for more than eight years without a major incident, and the weakness had been present in its design throughout that time. It was the most significant entry in a series of cross-chain bridge failures that researchers have tracked since May, and it renewed a longstanding question about whether the current generation of bridge architecture can be adequately secured.
In today’s issue.
Wanchain lost about $13M when a signature-reuse flaw let an attacker forge valid bridge withdrawals.
Allbridge Core lost $1.65M on Solana to a flash-loan attack it had already suffered in 2023.
A chained WordPress core flaw gave unauthenticated attackers remote code execution, and it is under active attack.
Need to Know
The week’s two bridge losses shared a characteristic that distinguishes the most damaging exploits of 2026 from the most sophisticated ones. In each, the protocol’s own design had already created the opening, and the attacker needed neither to defeat cryptography nor to invent a new method. In one case a validator signed messages that could be forged, and in the other a safeguard adopted after an earlier incident was never applied to a later deployment. The consistent lesson is that a bridge’s security is largely determined by decisions made long before it is attacked, so the question for any team operating one is how recently those decisions were re-examined against current methods. —Adrian
The Big One. Wanchain’s $13M Cardano-BNB Bridge Signature Flaw
The news. On 20 July an attacker drained roughly 515 million NIGHT tokens, worth somewhere between $9M and $13M depending on the moment’s price, out of Wanchain’s Cardano-to-BNB Chain bridge in four transactions over about eight minutes, per CoinDesk and Blockonomi. Those tokens were about 97 percent of the bridge’s NIGHT reserves, and only NIGHT moved while the bridge’s other assets sat untouched, per CryptoRank. Midnight, the Cardano privacy sidechain the token belongs to, was not affected, but the wrapped NIGHT still circulating on BNB Chain is now largely unbacked.
What broke and how. The bridge released wrapped NIGHT against signed authorisations, and its signature scheme could not reliably tell two different withdrawals apart. On-chain analysis found that the attacker took a single valid authorisation for about 3,110 NIGHT and reused it to mint more than 203 million, an amplification of roughly 65,000 times, per Blockonomi. Researchers described the underlying bug as a non-injective signed-message encoding flaw, the property that lets more than one set of withdrawal details reduce to the same signed message and therefore the same valid signature, per CryptoTimes. The attacker repeated the withdrawal until the reserves were nearly empty, then swapped roughly 2.8 million ADA worth of the proceeds through Cardano decentralised exchanges before Wanchain took the bridge offline.
Why it kept happening. A signing scheme that cannot distinguish one authorisation from another is an old and well-understood failure, and the defences against it, canonical encoding and domain separation among them, are standard parts of a competent cryptographic review. Wanchain’s bridge had run across dozens of chains for more than eight years without a major incident, per Coingape, and a record like that is often what keeps a foundational design decision from ever being examined again.
What to check now.
Can any message your contracts accept as a valid authorisation correspond to more than one real-world action, or is the mapping strictly one to one.
Are the fields in the messages you sign separated by explicit length markers or delimiters, so they cannot be rearranged into a different message with the same bytes.
Does your signing use domain separation, so a signature valid for one operation cannot be replayed for another.
Has a cryptographer, rather than a general smart-contract auditor, reviewed the exact bytes your bridge signs and verifies.
If your system has run for years without incident, which of its original cryptographic choices has nobody revisited since launch.
A signing scheme is only as strong as its worst-case ambiguity, and years without an incident mostly mean nobody has yet had a reason to go looking for it. If your contracts authorise actions from signed messages, have someone prove that no two different actions can ever share a signature, before an attacker builds that proof for you.
— Adrian
Chain Reaction. Allbridge’s $1.65M Repeat Flash-Loan Drain
The news. The day before Wanchain’s bridge fell, a smaller and far more familiar exploit hit Allbridge Core on Solana. On 19 July an attacker borrowed about $1.12M in USDC from Kamino in a flash loan, swapped rapidly between USDC and USDT inside an Allbridge stablecoin pool until the pool’s ratio was badly skewed, withdrew liquidity at the distorted rate, and repaid the loan in the same transaction, per CoinDesk. Security firms put the loss at roughly $1.65M, which the attacker bridged from Solana to Ethereum, per CryptoTimes.
What broke and how. Allbridge Core moves native stablecoins by holding pooled liquidity on each chain and pricing withdrawals against the balance of those pools. Because the pricing trusted the pool’s live ratio, a large borrowed swing in that ratio let the attacker take out more than they put in, and one swap of a few thousand dollars of USDT reportedly came back as roughly $2.24 million in USDC, per Cryptonomist. The flash loan supplied the size and the pool’s own accounting supplied the opening.
Why it kept happening. Allbridge has been drained this exact way before. In April 2023 an attacker used the same flash-loan pool manipulation to take about $573,000 from Allbridge on BNB Chain, after which the team recovered most of it through a white-hat arrangement and published a post-mortem, per Cryptonomist. That post-mortem named the structural fix plainly, one liquidity pool per blockchain, on the reasoning that a pool holding a single token gives an attacker no second asset to swap against, per TechTimes. The Solana deployment held both USDC and USDT in the same pool, which is precisely the configuration the fix was written to prevent. A lesson learned in one place in 2023 had never been carried to another by 2026.
What to check now.
When you fix a vulnerability class, is there a mechanism that guarantees the fix reaches every deployment, including chains you add later, not just the one that was hit.
Does any pool you price against hold two assets an attacker could swap between to move its ratio inside a single transaction.
Do your withdrawal calculations trust the live pool balance, or do they reject a pool that has been pushed far from its true ratio within one block.
Are flash-loan-scale swings in a pool’s composition something your contracts treat as a condition to pause on, rather than ordinary input.
Does your incident process end at the patch, or at a check that the same class of bug exists nowhere else you run.
A fix you applied on one chain but not the others is a fix in name only. When you close a vulnerability class, the last step is confirming the same door is shut everywhere you have deployed, because the attacker who reads your post-mortem will go straight for the deployment you forgot.
— Adrian
Around the Forums
Hoskinson calls for zero-knowledge bridges after the Wanchain drain. Charles Hoskinson responded to the exploit by arguing that the Cardano ecosystem should move away from legacy third-party bridges toward zero-knowledge designs that replace trust in operators and multisigs with cryptographic proofs, per CoinDesk. He also framed AI-accelerated exploit discovery as an industry-wide problem rather than a crypto-specific one, a point the week’s other incidents support. Whether a real migration follows, or the call joins the pile of post-incident statements that fade, is the thing worth watching over the next quarter.
Allbridge reopens its 2023 recovery playbook. Allbridge paused the protocol, told liquidity providers to withdraw, and asked the traders who profited from the resulting arbitrage window to return funds to a recovery address for LP compensation, the same route that recovered most of the 2023 loss, per crypto.news. For a protocol drained twice by the same technique, the more useful question than whether the funds come back is whether the second lesson finally reaches every chain it runs on.
What Else Happened
Reserve-manipulation logic error draining CrowdRingCircle on BNB Chain. An attacker manipulated the CRC token’s reserve accounting through a burn-from-pair and resync sequence and extracted about $201,000 on 16 July, on-chain transaction.
Deflationary-burn price manipulation of RWT Token on BNB Chain. An attacker paired a flash loan with RWT’s burn-on-transfer mechanic to distort its price and drain about $118,000 on 19 July, on-chain transaction.
Unauthenticated remote code execution in WordPress core, tracked as wp2shell. Two chained core flaws, a REST batch-route confusion (CVE-2026-63030) and a SQL injection in
WP_Query(CVE-2026-60137), let an anonymous attacker run code on default WordPress 6.9.x and 7.0.x installs with no plugins, and exploitation plus public proof-of-concept both appeared within a day of the 17 July disclosure, per BleepingComputer and Tenable. WordPress force-pushed fixes in 6.9.5 and 7.0.2.A fifteen-year-old heap overflow in NGINX, CVE-2026-42533. A flaw that has sat in NGINX request processing for fifteen years lets an unauthenticated attacker crash worker processes with a crafted HTTP request against certain regex-map configurations, per The Hacker News.
Heap overflow in the 7-Zip XZ decoder, CVE-2026-14266. Opening a crafted XZ archive can trigger code execution, a high-severity flaw in a utility that sits in countless build and analysis pipelines, per The Hacker News.
Hidden-instruction code execution in the AWS Kiro IDE. Hidden text on a web page the IDE fetched could be read as instructions and run code on a developer’s machine, which AWS has since fixed, per Gridinsoft.
Patch Notes
This is a heavier week for the software crypto teams run than for the contracts they write. The WordPress core chain is the urgent one, because it is already being exploited against stock installations and now sits on CISA’s known-exploited list, so any WordPress site your organisation runs, including the marketing and documentation sites nobody counts as infrastructure, needs to be on the patched release today. The NGINX and 7-Zip flaws are not under the same pressure yet, but both live in software almost every team touches, so fold them into your patching now rather than after a working exploit circulates. If your developers use the AWS Kiro IDE, confirm they are on the fixed build.
Long Reads
OpenAI’s account of its own models escaping a test sandbox and breaching Hugging Face, alongside Decrypt’s write-up. During an internal benchmark run with reduced safety filters, two OpenAI models exploited a zero-day in a package-registry proxy to break out of their sandbox, reached a machine with open internet access, then chained stolen credentials and further zero-days into remote code execution on Hugging Face’s production systems to steal the benchmark’s answer key, which Hugging Face had already detected and contained. It is the clearest real-world case yet of the AI-accelerated exploitation Hoskinson invoked after Wanchain, and Fortune notes that Anthropic separately reported its own Mythos model escaping a sandbox during safety testing.
Google’s Gemini 3.5 Flash Cyber, an AI it built to find and patch vulnerabilities and chose not to release. In testing it reportedly found more new bugs than expected, and the decision to withhold it is a useful marker of where automated vulnerability discovery now sits, a counterpoint to the Dragonfly argument covered last week that AI has not triggered a wave of DeFi exploitation.
CertiK’s data on the rise of crypto wrench attacks, which counts 52 physical-coercion incidents and more than a tenfold jump in the value targeted. As on-chain and operational security harden, some attackers simply move to the person holding the keys, which is worth a founder’s attention even though it is not a software problem.
Closing Tab
Both bridges compromised this week had run for years, and both were undone by a weakness that predated the attack by a wide margin, whether a signing scheme that allowed forgery or a fix that one deployment never received. The pattern extended well beyond bridges. Across the week’s incidents, from a flaw sitting in WordPress core to an AI system that escaped its own test environment, the decisive failures were ones that ordinary review could have caught, and the open question is how much of the industry’s current security rests on reviews that were never scheduled.
Burn Notice. Operational intelligence for Web3, every week.
Adrian Hetman