- An attacker minted 10 million unauthorised CYS on BNB Smart Chain on Saturday through Cysic’s cross-chain bridge.
- Cysic blacklisted the receiving address at 13:47:52 UTC, freezing about 2.8 million CYS still held there.
- On-chain records show about US$727,000 (AU$1.05 million) in proceeds reached Ethereum, while Cysic has yet to put a figure on its losses.
Cysic has shut its cross-chain bridge after an attacker used it to mint 10 million unauthorised CYS tokens on BNB Smart Chain on Saturday.
The Cysic Foundation said in an incident report on Sunday that the attacker got into a database used by services supporting the bridge. From there, the attacker exploited a flaw in the processing logic to submit a fraudulent mint message, according to the foundation’s preliminary findings. The full attack path and root cause are still under investigation.
That mint landed at 12:31:38 UTC, sending every token to a single address. The token is issued by Cysic, which builds hardware and a prover network for zero-knowledge proofs.
Related: White House Crypto Adviser Departs as CLARITY Act Remains Stalled
Cysic added the receiving address to a blacklist in the CYS token contract at 13:47:52 UTC. About 2.8 million CYS still sit at that address, and transfers out of it are blocked.
The other 7.2 million had already gone, and on-chain records show the attacker sold them for USDT and BNB. From those sales, 588,315 USDT left the address. The proceeds were then bridged to Ethereum, where they came to about 306.6 ETH, worth roughly US$727,000 (AU$1.05 million) at the time.
Mainnet and User Funds
The foundation said the incident was confined to the bridge’s message processing and minting functions. It said mainnet consensus, block production and transaction execution were not affected.
The bridge will stay closed until a security review of its full operational workflow is complete. That review covers message processing, permission settings and related asset records, the foundation said. Cysic has hired a security firm, which it did not name, to investigate the attack path and trace the funds.
CYS traded at US$0.116 (AU$0.17) on Monday, according to CoinGecko. That price was down about 9.2% over 24 hours and 23% over seven days.
NEAR Intents, another cross-chain service, halted its cross-chain trading service after a US$3.8 million (AU$5.47 million) exploit on 1 October. NEAR co-founder Illia Polosukhin said that the exploit was isolated to USDT on BNB Smart Chain.
CrossCurve’s bridge lost about US$3 million (AU$4.32 million) on 31 January after attackers submitted fabricated cross-chain messages that bypassed its gateway checks.
Read more: Ledger Sales Pulled in Europe – Firm Also Seeks Southeast Asia Suspension
Be the first to comment