Cysic

Minted

Ethereum

<h2 id="b-tldr-b">TLDR:</h2>
<ul>
 <li style="font-weight: 400">Cysic halted its bridge after an attacker minted 10 million CYS tokens without backing on BNB Smart Chain.</li>
 <li style="font-weight: 400">Cysic blacklisted the wallet about 76 minutes later, restricting 2.8 million CYS, or 28% of the mint.</li>
 <li style="font-weight: 400">Initial on-chain reports link sales of 7.2 million CYS to 306.6 ETH worth roughly $727,000 on Ethereum.</li>
 <li style="font-weight: 400">The 10 million unauthorized tokens equaled 1% of total supply, while mainnet operations remained unaffected.</li>
</ul>
Cysic suspended its cross-chain bridge after an attacker created 10 million unauthorized CYS tokens on <a href="https://blockonomi.com/bnb-smart-chain-rises-in-2026-with-record-speed-burns-and-expanding-rwa-ecosystem/" rel="noopener noreferrer nofollow">BNB Smart Chain</a> and moved reported proceeds to Ethereum. The October 17 breach exposed faulty authentication of bridge messages authorizing token issuance.
The mint occurred at 12:31:38 UTC, according to its <a href="https://x.com/cysic_fdn/status/2111761749116637687?s=20" rel="noopener noreferrer nofollow">October 18 incident report</a>. Investigators traced the breach to unauthorized access to a bridge database. The attacker then exploited a message-processing vulnerability to submit fraudulent mint instructions without a corresponding asset transfer.
On-chain activity cited in initial reporting linked the incident to sales of 7.2 million tokens and approximately 306.6 ETH received on Ethereum. Those proceeds were valued near $727,000, although the foundation has not verified the complete transaction trail or final losses.
<h2 id="b-how-hacker-minted-10m-cys-before-cysic-suspended-its-bridge-b">How Hacker Minted 10M CYS Before Cysic Suspended Its Bridge</h2>
<a href="https://blockonomi.com/millions-lost-after-series-of-cross-chain-bridges-hacked/" rel="noopener noreferrer nofollow">Cross-chain bridges</a> use authenticated messages to recognize transfers between blockchains and release matching assets. In this case, fraudulent instructions caused the system to mint tokens that lacked a legitimate transfer backing them. The breach therefore centered on bridge message validation, rather than a breakdown in the underlying network’s consensus.
Cysic blacklisted the receiving address at 13:47:52 UTC, about 76 minutes after the mint. By that point, 2.8 million tokens remained in the blocked wallet. That was 28% of the issuance; the remaining 7.2 million, or 72%, had moved out. The project’s <a href="https://moneycheck.com/david-schwartz-highlights-cross-chain-bridge-vulnerabilities-after-kelp-dao-attack/" rel="noopener noreferrer nofollow">cross-chain bridge</a> was suspended to prevent further unauthorized activity.
An external security firm is now examining bridge messages, permissions and asset records, while investigators trace affected addresses. The bridge remains closed without a reopening date, pending security review and validation.
<h2 id="b-unauthorized-10m-cys-mint-equals-1-of-supply-as-probe-continues-b">Unauthorized 10M CYS Mint Equals 1% of Supply as Probe Continues</h2>
The scale of the issuance matters beyond the reported transfer proceeds. <a href="https://docs.cysicfoundation.org/" rel="noopener noreferrer nofollow">Project tokenomics document</a> a total supply of 1 billion tokens, used for governance, computing services and network incentives. The 10 million unauthorized units equaled 1% of that stated supply, raising questions about unrecovered circulation.
However, the amount transferred to <a href="https://parameter.io/starkware-introduces-privacy-layer-with-shadow-accounts-feature-on-ethereum-l2/" rel="noopener noreferrer nofollow">Ethereum</a> should not be treated as the confirmed financial loss. Although initial tracking attributed 306.6 ETH to the attacker, the foundation has yet to establish how much was ultimately retained. Similarly, the 2.8 million restricted tokens are a verified containment measure, not evidence of recovery.
<a href="https://coincentral.com/aptos-launches-encrypted-mempool-on-mainnet-to-stop-mev-attacks/" rel="noopener noreferrer nofollow">Mainnet consensus</a>, block production and transaction execution continued normally, and existing assets in users’ wallets were unaffected. Users have also been warned against fake compensation links, recovery pitches and requests for private keys. A follow-up report is expected to address verified losses, fund tracing and remediation.
The post <a href="https://blockonomi.com/cysic-suspends-bridge-after-hacker-mints-10m-cys-moves-727k-to-ethereum/" rel="noopener noreferrer nofollow">Cysic Suspends Bridge After Hacker Mints 10M CYS, Moves $727K to Ethereum</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Cysic Suspends Bridge After Hacker Mints 10M CYS, Moves $727K to Ethereum

Table of Contents

Blockonomi

Other articles published on Oct 18, 2026

Join our free newsletter for daily crypto updates!