TLDR
- An attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain on Saturday, and Cysic suspended its bridge.
- The attacker sold 7.2 million tokens and bridged about 306.6 ETH, worth roughly $727,000, to Ethereum.
- Cysic blacklisted the address 76 minutes after the exploit, freezing about 2.8 million CYS.
- Cysic says the mainnet and existing user assets were not affected.
- The bridge stays closed until a security review is complete.
Cysic has suspended its cross-chain bridge after an attacker minted 10 million CYS tokens on BNB Smart Chain. The Cysic Foundation shared details in an incident report on X on Sunday.
On Oct 17, a security incident involving the unauthorized minting of 10M CYS occurred through the Cysic bridge.
Our team responded swiftly. User wallets and mainnet operations remain unaffected.
The bridge remains suspended pending security review.
Full update below. 👇 https://t.co/t0CT9LNXGJ
— Cysic (@cysic_xyz) October 18, 2026
The mint happened at 8:31 a.m. ET on Saturday, according to onchain data. Cysic says the attacker exploited a flaw in the bridge’s processing logic to submit a fake mint message.
Early findings point to unauthorized access to a database that supports the bridge. Cysic hired a security firm, which it did not name, to investigate and trace the funds.
The foundation said the issue was limited to bridge message processing and minting. The Cysic mainnet and other operational systems were not affected.
“Existing user assets were not stolen,” the foundation said. Cysic added that the number of tokens minted does not by itself show the final loss in dollars.
Cysic was founded in 2022 and raised a $6 million seed round led by Polychain Capital in 2023. About 160.8 million CYS tokens are in circulation, according to CoinMarketCap.
How the attacker sold the tokens
The receiving address began moving CYS five minutes after the mint, BscScan records show. It sent out 7.2 million tokens in 26 transfers by 8:59 a.m. ET.
The tokens were sold in two rounds. From 8:36 to 8:41 a.m. ET, the address sold 5.65 million CYS for 588,315 USDT, or about 10 cents per token.
From 8:57 to 8:59 a.m. ET, it sold the remaining 1.55 million CYS for about 220 BNB. Twelve of the 15 transactions went through OKX’s DEX aggregator.
Cysic added the address to the token contract’s blacklist at 9:47 a.m. ET. That was 76 minutes after the first exploit transaction, and it froze about 2.8 million CYS.
Funds moved to Ethereum
At 8:44 a.m. ET, the address sent 100,000 USDT to a SWFT contract and received 40.88 ETH on Ethereum about a minute later. It sent the other 488,315 USDT to Mayan.
It later bridged 80 BNB through Mayan and 139 BNB through deBridge. In total, the address received about 306.6 ETH, worth roughly $727,000 at Sunday’s price of about $2,372.
The address then moved 306.52 ETH to a second wallet by 9:11 a.m. ET. That wallet held about 309.5 ETH on Sunday morning.
Cysic’s blacklist applies only to CYS on BNB Chain, so it does not affect the ether.
The bridge will stay closed until a security review is complete. Cysic plans to publish a follow-up report on verified losses and its efforts to trace the funds.
Be the first to comment