Cysic Foundation says a cross-chain bridge exploit minted 10 million CYS without authorization, and blacklisted the address still holding 2.8 million.
Key Facts
Cysic Foundation said an attacker exploited a vulnerability in its cross-chain bridge's message-processing logic to mint an unauthorized 10,000,000 CYS on BNB Smart Chain on Oct. 17, and suspended the bridge in response.
On-chain data reviewed by CoinMarketCap matches Cysic's account: the recipient address received 10 million minted tokens, routed roughly 7.2 million out through decentralized-exchange swaps, and still held about 2.8 million CYS when Cysic blacklisted the address on-chain roughly 76 minutes after the mint.
CYS traded at $0.1144, down 1.92% over 24 hours, according to CoinMarketCap data, while Cysic said the 10 million token count does not by itself represent the incident's final dollar loss.
Cysic Foundation said an attacker exploited a vulnerability in its cross-chain bridge's message-processing logic to mint 10,000,000 Cysic (CYS) tokens without authorization on BNB Smart Chain, prompting the foundation to suspend the bridge and blacklist the recipient address.
The minting occurred at 12:31 pm UTC on Oct. 17, according to an incident report Cysic published on X. Preliminary findings indicate the attacker gained unauthorized access to a database supporting the bridge and exploited a bug in the processing logic to submit a fraudulent mint message, Cysic said, adding that the full attack path and root cause remain under investigation.
Cysic said the incident was isolated to the bridge's minting and message-processing functions and did not reach the Cysic mainnet, and that existing CYS and other assets already held in user wallets were not stolen or moved. The foundation added the recipient address to the CYS token contract's on-chain blacklist at 1:47 pm UTC, restricting further transfers, and has engaged a security firm to trace the funds and investigate.
On-Chain Data Backs Cysic's Account of the Incident
BscScan records reviewed by CoinMarketCap show the recipient address received a single 10,000,000 CYS transfer from the null address, the on-chain signature of a mint, matching Cysic's stated timestamp. From there, 23 separate outbound transactions, mostly routed through decentralized-exchange pools, moved a combined 7.2 million CYS out of the address, leaving about 2.8 million CYS still there, in line with the "approximately 2.8 million" Cysic said remains restricted.
CYS, a BEP-20 token, traded at $0.1144, down 1.92% over the past 24 hours, according to CoinMarketCap data, with a market capitalization of about $18.4 million. Cysic has not published an estimate of the incident's dollar impact, saying verified losses and fund-tracing progress will appear in a follow-up report.
The bridge remains closed and will reopen only once Cysic completes its security review, which the foundation said includes examining the bridge's message-processing and permission configurations. A similar flaw surfaced elsewhere this year: a bug in the XRP Ledger's payment engine, patched in September, could likewise have let an attacker create spendable tokens from nothing, though the flaw was caught before anyone exploited it, according to a vulnerability disclosure report.
CYS
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.
