Another Bridge Hack: 10 Million Tokens Minted Without a Single Deposit

All news is rigorously fact-checked and reviewed by leading blockchain experts and seasoned industry insiders.

• A bridge hack let an attacker mint unauthorized CYS tokens on BNB Smart Chain, forcing Cysic to suspend its bridge.
• Preliminary findings point to a breached database and a flaw in how the bridge processed mint messages.
• Cysic says its mainnet and assets already held in user wallets were not touched.
• The attack extends a run of unbacked token mints on cross-chain bridges this year.

A bridge hack has forced Cysic, a zero-knowledge proving network, to shut down its cross-chain bridge after an attacker used it to mint 10 million CYS tokens on BNB Smart Chain on October 17 without any matching deposit on another network. In a preliminary report published on X on October 18, the Cysic Foundation said the attacker gained access to a database used by services supporting the bridge and abused a weakness in how mint messages were processed, while stressing that its mainnet and the assets already held in user wallets were not affected. The foundation blacklisted the receiving wallet 76 minutes after the mint, and by that point only about 2.8 million of the new tokens were still sitting there.

How 10 Million CYS Reached BNB Chain

Cysic’s bridge moves CYS between the project’s own chain and outside networks, including BNB Smart Chain and Base. The rogue mint went through at 12:31:38 UTC, and once the team added the recipient address to the token contract’s blacklist at 13:47:52 UTC, roughly 28% of the issuance was frozen in place. The remaining 7.2 million CYS had already left that wallet, although tokens that moved are not automatically tokens that were sold, and Cysic says it is still tracing transfers and swaps before it puts a dollar figure on the damage. On-chain flows reviewed after the incident suggest that around $727,000 in value was moved to Ethereum, a number the foundation has not confirmed.

Cysic Bridge Hack Timeline

Oct 17, 12:31 UTC
10 million CYS minted on BNB Smart Chain without a matching deposit

Oct 17, 13:47 UTC
Receiving wallet blacklisted, about 2.8 million CYS frozen

Oct 18
Preliminary report confirms bridge suspension and external security review

Next steps
Loss assessment, fixes and security sign-off before the bridge reopens 

The 10 million tokens equal 1% of the project’s stated 1 billion CYS total supply. For holders, the larger risk lies in the 7.2 million that escaped the freeze, because the attacker can still push any unsold portion into thin order books whenever an exit route opens up.

Why the Contract Obeyed a Fake Order

Everything a bridge does depends on one check: before it mints tokens on the destination chain, it has to confirm that the same amount was locked or burned on the source chain. Many bridge contracts cannot check that on their own and instead rely on a relayer or message service to deliver the confirmation, so anyone who can write to the database behind that service can hand the contract an instruction that looks valid, and the contract will execute it even though no deposit ever happened. Cysic’s security documentation lists third-party audits covering its token contracts, minting permissions and bridge infrastructure, yet the preliminary report does not say whether the database-processing path the attacker used fell within the scope of those reviews, and it has not explained how the database was reached in the first place.

The blacklist cuts both ways. Without an admin function able to freeze an address, all 10 million CYS would have been free to move, but the same power lets a small group of keyholders lock any wallet holding the token, which is a trade-off that holders of centrally administered tokens accept whether or not they think about it.

Five Months of Bridge Failures

Cysic’s is the second bridge hack to end in an unbacked mint in less than a week, and the list stretches back to spring.

Figures from project disclosures and independent on-chain analysis.

Autheo’s case sits closest in time. Block explorer data shows 19 million unbacked THEO minted on Base on October 12, and one on-chain researcher has claimed the total reached 119 million, a figure Autheo has not confirmed. Security monitors traced the mint to a bridge route that relied on a single trusted relayer to approve incoming messages, and Autheo told holders not to buy, sell or bridge THEO until it issued an all-clear.  Alephium is the nearer match technically, since a flaw in an off-chain verification step let attackers trigger bridge messages in May, and the team later said it burned 96.4% of the unbacked tokens and shipped independently audited fixes.

Security firm Nominis counted about $776 million stolen across 48 major incidents in September, of which eight involved bridges or interoperability systems and accounted for roughly $11 million. Bridge losses are a small slice of the dollar total in that report, yet unbacked minting appeared often enough among them that Nominis flagged it as a recurring outcome.

What Cysic Must Show Before Reopening

The bridge stays closed until the external security firm, which Cysic has not named, completes its review, and the foundation has promised a follow-up report covering verified losses and fund tracing. Holders will look first at how the attacker reached the database and whether the frozen 2.8 million CYS will be burned, since destroying them would cut the unauthorized supply left on BNB Chain to the 7.2 million that already moved.

The report has also not said whether the bridge enforced any ceiling on the size of a single mint. A 10 million token issuance clearing in one transaction suggests that either no per-transfer cap existed at that level or it sat above it, and rate limits combined with delayed settlement for unusually large transfers are among the controls bridge teams most often add after an incident like this one, at the cost of slower transfers for ordinary users.