Cysic has suspended its cross-chain bridge after an attacker reportedly exploited a processing flaw to mint 10 million CYS tokens without authorization on BNB Smart Chain on October 17.
Summary
- Cysic suspended its cross-chain bridge after an attacker reportedly minted 10 million unauthorized CYS tokens.
- The attacker allegedly exploited bridge processing weaknesses after gaining unauthorized access to a supporting database system.
- Cysic blacklisted an address holding approximately 2.8 million CYS, restricting further transfers from that wallet.
- The project said its mainnet remained unaffected and existing customer wallet assets were not stolen.
- Investigators are reviewing token movements and potential losses before Cysic releases its next security report publicly.
In an October 18 statement, the Cysic Foundation said its preliminary investigation identified unauthorized access to a database supporting the bridge, followed by the submission of fraudulent minting messages.
The company confirmed that it had stopped bridge operations and restricted transfers from an address holding approximately 2.8 million CYS. It said its mainnet and other operational systems remained unaffected, while investigators continued examining the movement of the newly created tokens.
Cysic has not established a final financial loss. Its incident report distinguishes the number of tokens created from the value an attacker may have obtained through completed transactions.
Cysic bridge exploit creates 10 million unauthorized tokens
The attack took place on October 17, with the unauthorized mint recorded at 12:31:38 UTC, according to the project’s incident timeline.
Preliminary findings indicate that the attacker accessed a database used by Cysic’s cross-chain bridge and exploited weaknesses in its message-processing logic.
The bridge processes instructions associated with transfers between supported networks. In this incident, the attacker allegedly manipulated that process to authorize the creation of CYS tokens on BNB Smart Chain.
The Foundation has described the affected components as bridge message processing and minting. It has not identified a compromise of the underlying Cysic mainnet.
Following the unauthorized issuance, the team suspended the bridge to prevent further activity through the affected service while the investigation continued.
The technical findings remain preliminary. Cysic has not released a complete account of the database access method, the precise code weakness or the sequence of transactions used to trigger the mint.
No independent forensic report was available in the material accompanying the initial announcement.
Cysic blacklists wallet holding 2.8 million CYS
After detecting the attack, the team identified a recipient address associated with the unauthorized tokens.
At 13:47:52 UTC on October 17, Cysic added the address to the token contract’s blacklist, preventing it from transferring the tokens remaining at that location.
The restriction came one hour, 16 minutes and 14 seconds after the reported mint.
Approximately 2.8 million CYS remained at the blacklisted address. Using the announced 10 million-token issuance as the reference amount, the restricted balance represented 28% of the unauthorized mint.
The other 7.2 million tokens were not included in that reported remaining balance. Their absence from the restricted address does not establish how many were sold, transferred elsewhere, recovered or converted into other cryptocurrencies.
Cysic said investigators were tracing token transfers and reviewing possible swaps to determine the actual financial consequences.
The company has not published a verified total for proceeds received by the attacker, a complete list of recipient addresses or an independent valuation of assets that may have left the affected system.
Although the unauthorized mint involved 10 million CYS, the issuance figure cannot be treated as a confirmed dollar loss.
A calculation based on a token’s market price would estimate the notional value of the newly created supply. It would not establish the amount an attacker could actually sell or withdraw from available trading liquidity.
Cysic has not reported a completed recovery of the tokens outside the blacklisted address.
Cysic says mainnet and existing wallet assets remain safe
In its initial assessment, the Foundation limited the breach to its cross-chain bridge infrastructure.
The company said the incident did not affect Cysic mainnet operations or other parts of its network. It reported no unauthorized removal of existing CYS balances or other assets from customer wallets.
Those statements describe the project’s preliminary findings. They do not amount to a completed independent security audit.
A cross-chain bridge allows tokens or transfer instructions to move between separate blockchain environments. Bridge operators commonly rely on processing systems that verify activity on one network before authorizing corresponding activity on another.
Cysic’s reported attack involved the authorization of new tokens through manipulated messages. The available disclosure does not describe attackers directly withdrawing the underlying assets from users’ wallets.
The Foundation has engaged an external security company to examine the incident and trace the activity connected to the unauthorized issuance.
Its investigation covers the attack path, affected infrastructure and the movement of minted tokens. The project intends to publish a follow-up report after the current review.
No reopening date for the suspended bridge has been announced.
CYS powers computing and governance within the network
Cysic describes its platform as a decentralized computing network that uses blockchain technology to coordinate computing resources and reward participants.
According to its official tokenomics, CYS supports network governance, access to computing resources and payments to participants who provide hardware or perform computing tasks.
The project’s published token supply is 1 billion CYS, with separate allocations for ecosystem incentives, investors, contributors, its foundation treasury and community liquidity programs.
The unauthorized 10 million-token mint equals 1% of that stated total supply, based on the project’s tokenomics figures.
The comparison measures the scale of the unauthorized issuance against the published supply. It does not establish whether all the minted tokens entered circulation or changed the effective supply available for trading.
CYS holders can stake tokens to receive Cysic Governance Token, or CGT, which the project describes as nontransferable governance credit.
Under its published design, CGT supports participation in protocol proposals, validator selection and decisions involving network economic parameters.
Compute providers use CYS to reserve capacity for tasks including zero-knowledge proof generation and artificial intelligence workloads. The token is used for incentives tied to those activities.
The Foundation’s allocation schedule assigns 40.19% of the token supply to ecosystem incentives, 23.62% to investors and 12.11% to contributors.
Another 8% is allocated to the foundation treasury, while community incentives and liquidity account for 16.08%.
Other bridge incidents show why minted supply and losses differ
Unauthorized token creation has appeared in several other cross-chain security incidents during 2026, although the technical causes and financial consequences have varied.
In August, crypto.news reported a bridge exploit involving The Sandbox’s SAND token on Base and BNB Smart Chain.
The Sandbox suspended affected bridge operations after attackers created unauthorized tokens through compromised permissions. Its initial response distinguished the newly minted supply from the assets directly affected.
A subsequent analysis of the attack found that approximately 329 trillion unbacked SAND tokens had been created, while the confirmed reserve drain was much smaller, at roughly $675,000.
During a separate incident in May, Stake DAO closed its affected bridge after an attacker minted unauthorized vsdCRV on Arbitrum.
The project said its Ethereum mainnet backing remained secured and that key products continued operating.
More recently, an October 13 report covered a suspected bridge exploit affecting Autheo’s THEO token. Security firm PeckShield reported that an attacker created 19 million THEO and exchanged tokens for approximately 700.8 ETH.
Cysic’s investigation has not yet established a comparable figure for assets exchanged or withdrawn. The Foundation plans to release a further report after the security review produces more complete findings.
Be the first to comment