- Attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain through Cysic’s bridge on October 17.
- Sold 7.2 million CYS and bridged approximately $727,000 in proceeds to Ethereum before the address was blacklisted.
- Bridge remains suspended; Cysic mainnet and existing user wallet assets were not affected.
The Cysic Foundation has suspended its cross-chain bridge after an attacker exploited a vulnerability in the bridge’s message-processing logic to mint 10 million unauthorized CYS tokens on BNB Smart Chain, the project said in its official incident report posted on October 18.
The unauthorized mint occurred at 12:31:38 UTC on October 17 to recipient address 0xA4e1827Fe2664fD0797a55e442b2e2639449C255. Preliminary findings indicate the attacker gained unauthorized access to a database supporting the bridge and submitted a fraudulent mint message. Cysic blacklisted the address in the CYS token contract at 13:47:52 UTC, roughly 76 minutes later, restricting transfers of the approximately 2.8 million CYS still held there.
Onchain records reviewed by The Block show the attacker sold 7.2 million CYS between about 8:36 and 8:59 a.m. ET and then bridged roughly 306.6 ETH ($727,000) to Ethereum through Mayan, deBridge and SWFT’s Bridgers before the blacklist took effect. Twelve of the 15 sale transactions were routed through OKX’s DEX aggregator.
Cysic stated that the incident was confined to the bridge’s message-processing and minting functions and did not affect the Cysic mainnet or other operational systems. “The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets,” the foundation wrote in the report. The project has engaged an unnamed security firm to investigate the full attack path and trace funds. Actual dollar losses remain under review, as the mint volume alone does not determine the final impact.
With roughly 160.8 million CYS in circulation according to CoinMarketCap data referenced in coverage by Cointelegraph, the unauthorized mint represents about 6% of circulating supply. The bridge remains closed pending a comprehensive security review, and Cysic warned users to ignore scam messages seeking seed phrases or promising refunds. Further updates on remediation and any restitution will be published through official channels.
