BTC $81,107 
ETH $2,366 
USDT $0.9992 
BNB $712.05 
XRP $1.27 
USDC $0.9998 
SOL $102.17 
TRX $0.3325 
FIGR_HELOC $1.08 
ZEC $1,081 Cysic bridge halted after unauthorized mint of 10M CYS
Cysic suspended its cross-chain bridge after an attacker minted 10 million CYS on BNB Smart Chain and moved part of the tokens to Ethereum.
Key takeaways
- Mint size. The attacker minted 10 million CYS, equal to 1% of the stated 1 billion token supply.
- Containment. Cysic blacklisted the address about 76 minutes after the mint, when 2.8 million CYS remained.
- Unverified losses. Initial reporting valued proceeds near $727,000, but the foundation has not confirmed final losses.
What happened
Cysic suspended its cross-chain bridge after an attacker exploited a processing flaw to mint 10 million CYS on BNB Smart Chain on October 17. Preliminary findings point to unauthorized access to a database that supports the bridge. The mint occurred at 12:31:38 UTC.
Cysic added the recipient address to the token contract's blacklist at 13:47:52 UTC, about 76 minutes after the mint. About 2.8 million CYS remained at that address, with transfers restricted. That was 28% of the issuance, while the remaining 7.2 million tokens, or 72%, had moved out.
Initial reporting linked the incident to sales of 7.2 million tokens and approximately 306.6 ETH received on Ethereum. Those proceeds were valued near $727,000, though the foundation has not verified the full transaction trail or final losses.
Cysic said the incident was limited to bridge message processing and minting and did not affect the mainnet or other operational systems. The project said existing CYS and other assets in user wallets were not stolen or transferred without authorization.
First $2.7KLatest $2.4K-11.9% over the period
Points are daily observations, not closing prices.
Why it matters
Cross-chain bridges rely on authenticated messages to recognize transfers between blockchains and release matching assets. In this case, fraudulent instructions caused the system to mint tokens without a legitimate transfer behind them, so the breach centered on bridge message validation rather than the network's consensus.
The size of the mint matters beyond the reported proceeds. Project tokenomics document a total supply of 1 billion tokens, and the 10 million unauthorized units equaled 1% of that stated supply, raising questions about unrecovered circulation.
The bridge remains closed without a reopening date pending a security review. Cysic has hired a security firm and plans a follow-up report after the current investigation phase. Users were warned against fake compensation links, recovery pitches and requests for private keys.
What is still unclear
- The number of tokens minted does not establish the final dollar loss, and token transfers, swaps and actual losses remain under review.
- The foundation has not verified the complete transaction trail, so the 306.6 ETH attributed to the attacker is not a confirmed final loss figure.
- The 2.8 million restricted tokens are a containment measure, not evidence of recovery.
Questions readers ask
How much CYS was minted in the Cysic bridge incident?
An attacker minted 10 million CYS on BNB Smart Chain, equal to 1% of the stated 1 billion token supply.
Is the Cysic bridge still closed?
Yes. The bridge remains closed without a reopening date pending a security review and validation.
Were user wallets affected by the Cysic incident?
Cysic said the incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets.
How much did the attacker move to Ethereum?
Initial reporting linked 7.2 million tokens to sales and approximately 306.6 ETH received on Ethereum, valued near $727,000, but the foundation has not verified final losses.
