Cysic halts cross-chain bridge after unauthorized mint of 10 million CYS on BNB Smart Chain
Key Takeaways
- •An unauthorized mint of 10 million CYS tokens occurred on BNB Smart Chain at 12:31:38 UTC on Oct. 17, prompting the suspension of Cysic's cross-chain bridge.
- •Early findings attribute the exploit to unauthorized access of a database used by the bridge, underscoring the role of off-chain infrastructure in bridge security.
- •Cysic blacklisted the recipient address about 76 minutes after the mint, leaving roughly 2.8 million CYS at that address under transfer restrictions.
- •The newly minted tokens equal approximately 6% of the roughly 160.8 million CYS currently in circulation.
- •The foundation stated the incident did not affect the mainnet or user wallet holdings, and an external security firm is assisting while the final financial impact remains undetermined.
Cysic Foundation is investigating an unauthorized token issuance on BNB Smart Chain and said the size of the mint alone does not establish the incident's dollar impact.
In an incident report posted on X on Sunday, the foundation said its cross-chain bridge was suspended after an attacker exploited a flaw in the bridge's message processing to mint 10 million CYS on BNB Smart Chain on Saturday. Preliminary findings point to unauthorized access to a database supporting the bridge — a reminder that bridge security depends on off-chain infrastructure as well as on-chain contracts.
According to the incident report on X, the unauthorized mint occurred at 12:31:38 UTC on Oct. 17. Cysic added the recipient address to the token contract's blacklist at 13:47:52 UTC, roughly 76 minutes later, leaving about 2.8 million CYS at the address with transfers restricted.
For scale, the unauthorized mint equals about 6% of the roughly 160.8 million CYS tokens in circulation, according to CoinMarketCap data.
CYS coordinates incentives for users, compute providers, governance participants and contributors across the Cysic network, according to the project's tokenomics documentation. Cysic is a zero-knowledge proof computing project focused on hardware-accelerated proof generation.
The foundation said the incident was limited to bridge message processing and minting and did not affect the mainnet or other operational systems. "The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets," it said.
The post said the number of minted tokens does not establish the final dollar loss, adding that token transfers, swaps and actual losses remain under review. Cysic has hired an unnamed security firm and plans to publish a follow-up report once the current investigation phase concludes. The outcome of that review will set the incident's final loss figure, while the roughly 2.8 million CYS at the blacklisted address remains under transfer restrictions.
Cross-chain bridges, which relay assets and messages between blockchains, have historically been among the most frequently targeted components of crypto infrastructure, in part because a flaw in how messages are verified can allow an attacker to mint or drain funds across multiple chains at once.
