[BlockSec: Wanchain's Cardano Cross-Chain Bridge Attacked, Approximately 515 Million NIGHT Tokens Stolen from the Bridge Treasury] According to monitoring by BlockSec, Wanchain's Cardano cross-chain bridge was attacked, resulting in the theft of approximately 515 million NIGHT tokens from the bridge treasury. Preliminary investigations indicate that the root cause lies in an issue with the non-injective signature message encoding in the TreasuryCheck validator. The signature message was constructed by concatenating 14 variable-length redemption fields (using AppendByteString folding) without separators or length prefixes, leading to different field value combinations producing identical byte strings. This allowed the reuse of the same hash and valid signature. BlockSec verified this vulnerability by decompiling the on-chain Plutus V2 bytecode and decoding the redemption data of the attack transaction.