Cysic suspends its cross-chain bridge after an unauthorized mint of 10 million CYS on BNB Smart Chain
Summary
Cysic said in an Oct. 18 X post that on Oct. 17 an unauthorized mint of 10 million CYS occurred through its cross-chain bridge, that user wallets and mainnet operations remain unaffected, and that the bridge stays suspended pending a security review.
Cointelegraph, citing Cysic’s Sunday X incident report, said preliminary findings point to unauthorized access to a database supporting the bridge and a processing flaw that let an attacker mint 10 million CYS on BNB Smart Chain at 12:31:38 UTC, with the recipient blacklisted at 13:47:52 UTC and about 2.8 million CYS left restricted.
The Block’s Oct. 18 onchain review said the attacker sold 7.2 million of the minted CYS before the freeze and bridged about $727,000 in proceeds to Ethereum — receiving roughly 306.6 ETH via Mayan, deBridge and SWFT’s Bridgers — then moved most of that ether to a second wallet.
Cysic said via Cointelegraph and The Block that the incident was limited to bridge message processing and minting, did not steal existing user assets, and that the mint size alone does not establish final dollar loss; it has hired a security firm and plans a follow-up report.
Updates
- Update, : Added The Block's Oct. 18 onchain follow-up: attacker sold 7.2M of the minted CYS and bridged about $727,000 (306.6 ETH) to Ethereum via Mayan, deBridge and SWFT Bridgers before the blacklist.
- Update, : Oct. 23: The wallet tied to the Cysic bridge exploit sent about $744,000 (300 ETH and 30.4 BNB) to the Tornado Cash mixer on Friday, per PeckShield, after the Cysic Foundation offered a 10% bounty on Thursday for the return of 275.872 ETH, Cointelegraph reported.
Key facts
- Cysic said on X: “On Oct 17, a security incident involving the unauthorized minting of 10M CYS occurred through the Cysic bridge. Our team responded swiftly. User wallets and mainnet operations remain unaffected. The bridge remains suspended pending security review.”
- The Cysic Foundation published an X Article titled “Cysic Incident Report” linked from its Oct. 18 post, which Cysic quoted in its update.
- Cointelegraph reported that preliminary findings point to unauthorized access to a database supporting the bridge, and that the incident was limited to bridge message processing and minting and did not affect the mainnet or other operational systems.
- Cointelegraph said the mint occurred at 12:31:38 UTC and Cysic added the recipient address to the token contract’s blacklist at 13:47:52 UTC, with about 2.8 million CYS remaining at that address under transfer restrictions.
- Cointelegraph quoted Cysic as saying the incident “did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets,” and that token transfers, swaps and actual losses remain under review.
- Cointelegraph said Cysic has hired a security firm and plans to publish a follow-up report after the current investigation phase.
- Cointelegraph noted that CYS coordinates incentives for users, compute providers, governance participants and contributors in Cysic’s network, according to the project’s tokenomics documentation.
- The Block, reviewing onchain records, said the attacker sold 7.2 million of the unauthorized CYS and bridged about $727,000 in proceeds to Ethereum, receiving about 306.6 ETH, before Cysic blacklisted the receiving address and froze the remaining 2.8 million CYS.
- The Block said the receiving wallet sold CYS from 8:36 to 8:59 a.m. ET — about 48 minutes before Cysic froze the address — and that twelve of fifteen sell transactions were routed through OKX’s DEX aggregator across venues including PancakeSwap.
- The Block reported first-round sales of 5.65 million CYS for a combined 588,315 USDT (about 10 cents per token) and a second round of 1.55 million CYS for about 220 BNB, with proceeds moved via SWFT Bridgers, Mayan and deBridge.
- The Block said the Ethereum-side address then sent about 306.52 ETH to a second wallet that held about 309.5 ETH as of Sunday morning, and noted Cysic’s CYS blacklist on BNB Chain does not affect the ether.
- The exploiter moved 300 ETH and 30.4 BNB, about $744,000, to Tornado Cash after Cysic offered a 10% bounty for returning 275.872 ETH, per PeckShield data cited by Cointelegraph.
Related stories
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor
- Indian exchange Unocoin keeps withdrawals frozen after spotting outgoing ether transfers from its BitGo wallets
- Ethlabs shelves faster Ethereum blocks to push quantum-resistant accounts into 2027, two years ahead of the official roadmap