Cysic halts bridge after attacker mints 10 million CYS tokens

Cysic suspended its cross-chain bridge on October 17 after someone minted 10 million CYS tokens out of thin air and sold most of them within half an hour. On-chain trackers put the proceeds near $727,000. The project says no user funds were taken.

Those figures come from blockchain news outlet The Block, which traced the value through BNB Chain and Ethereum explorers. Crypto news site crypto.news reported the same core events on its own. Cysic confirmed the breach in an incident report posted to X on October 18.

How the attack unfolded

An unauthorized mint hit the BNB Smart Chain at 12:31:38 UTC on October 17, going by Cysic's own timeline. Ten million CYS landed in a wallet that had no reason to hold them. Then the selling started.

That address offloaded 7.2 million CYS between 12:36 and 12:59 UTC, in two rounds, The Block reported. One trade swapped 5.65 million tokens for 588,315 USDT. A second took 1.55 million tokens for about 220 BNB. Twelve of the 15 sale transactions ran through OKX's on-chain trading aggregator, the outlet said.

From there the money moved to Ethereum. By 13:11 UTC the attacker was holding about 306.6 ETH, worth roughly $727,000 at an ether price near $2,372, shifted across using the bridging services Mayan, deBridge and SWFT, according to The Block. That cross-chain hop is what put the value out of Cysic's reach.

What Cysic froze, and what it could not

Cysic blacklisted the receiving address inside the CYS token contract at 13:47:52 UTC, about 76 minutes after the first bad transaction and 48 minutes after the wallet stopped moving tokens. That locked up the 2.8 million CYS still sitting there, roughly 28% of the minted batch. It did nothing for the value already bridged to Ethereum.

In its incident report, the foundation said the attacker "gained unauthorized access to a database used by services supporting the bridge" and used it to push a fake mint instruction through. It said its mainnet and other systems stayed untouched, and that "existing user assets were not stolen." An outside security firm has been hired to trace the funds. Cysic has not named it.

A dollar figure is the one thing Cysic will not give yet. It said the count of minted tokens "does not, by itself, represent the final loss in U.S. dollar terms," and promised a fuller report once the review wraps up. The bridge stays shut until then.

Another bridge, another weak point

Behind the bridge sits Cysic, a project that builds specialized hardware and runs a network for zero-knowledge proofs, the cryptography that lets blockchains verify heavy computation cheaply. CYS is its native token, and the cross-chain bridge is the plumbing that carries that token between networks. Bridges like it hold big balances and stitch together code from chains that were never built to trust each other. They are soft targets.

Measured in cash, the haul was small next to the headline. At 10 million, the mint is about 1% of the token's 1 billion supply, and much of it was frozen or sold off cheaply before the team could react. Similar worries about tokens being created outside the rules surfaced this month with a supply-cap bug on the XRP Ledger, though that case was a code flaw rather than a break-in. Readers tracking the sector can follow more coverage on the DeFi and protocols desk.

What to watch

Cysic's full post-mortem is the next marker. The foundation says it will lay out verified losses and track where the bridged ETH went. Two questions hang over any restart: whether Cysic can close the database gap that let the fake mint through, and whether it offers anything to holders left diluted by the extra supply. Neither has an answer yet.