Cysic Halts Bridge After 10 Million CYS Exploit Sends $727K to Ethereum

Cysic has suspended its cross-chain bridge after an attacker exploited its message-processing infrastructure to mint 10 million unauthorized CYS tokens on BNB Smart Chain, selling 7.2 million and moving approximately $727,000 in proceeds to Ethereum.

The October 17 attack exposed a vulnerability involving unauthorized database access and fraudulent minting instructions. Cysic subsequently blacklisted the recipient address, immobilizing the remaining 2.8 million tokens approximately 76 minutes after the unauthorized issuance.

The Foundation confirmed that the incident was confined to bridge infrastructure, with Cysic mainnet operations unaffected and no existing user wallet assets stolen.

Database Breach Allowed Unauthorized CYS Minting

The attack began at 12:31:38 UTC when an unauthorized minting transaction created the additional CYS supply on BNB Smart Chain.

Preliminary findings identified unauthorized access to a database supporting Cysic’s cross-chain services. The attacker exploited a weakness in the bridge’s message-processing logic to submit a fraudulent mint instruction that the system accepted.

The affected infrastructure handled cross-chain messaging and token issuance rather than the underlying network’s consensus operations. Cysic has engaged an external security firm to investigate the entry point, processing vulnerability and subsequent fund movements.

Cysic’s security identifies bridge message verification, minting controls and cross-chain asset integrity as previously audited components. The Foundation has not yet disclosed the complete technical attack path.

Attacker Sold 7.2 Million CYS Before Wallet Freeze

Onchain transaction tracking indicates that the attacker began moving tokens within five minutes of the unauthorized mint.

Approximately 5.65 million CYS were sold for 588,315 USDT during the first round of transactions. Another 1.55 million CYS were subsequently exchanged for approximately 220 BNB, with trades routed through decentralized exchange infrastructure, including PancakeSwap.

The proceeds moved from BNB Chain to Ethereum through Mayan, deBridge and SWFT’s Bridgers service. The receiving address accumulated approximately 306.6 ETH, valued at around $727,000 using Ethereum prices on October 18.

Cysic blacklisted the attacker’s CYS address at 13:47:52 UTC, preventing further transfers of its remaining balance. The restriction did not affect ETH already moved to Ethereum, with transaction tracking identifying a subsequent transfer to another address.

The unauthorized issuance represented approximately 6.2% of the 160.8 million CYS circulating supply and 1% of the token’s 1 billion total supply.

The number of tokens created is separate from the attacker’s realized proceeds, and Cysic has not established a final financial loss or recovered the bridged ETH.

Bridge Remains Suspended Pending Security Review

The attack involved unauthorized token creation rather than a direct withdrawal from a bridge liquidity pool. A similar supply-integrity issue affected the Syscoin bridge in June, when a validation flaw produced approximately 5 billion unauthorized SYS outputs.

Cysic’s cross-chain infrastructure remains suspended while investigators examine the compromised database, fraudulent minting instructions and remaining attacker-controlled assets.