An attacker used an exploit in the Cysic cross-chain bridge on BNB Smart Chain to create 10 million CYS without authorization. Cross-chain bridges move tokens between networks by relaying messages between contracts, and a fraudulent message in that flow can trigger unauthorized token creation on the destination chain. Cysic subsequently blacklisted the recipient address, restricting transfers of approximately 2.8 million CYS that remained there. The foundation said no assets on the Cysic mainnet or existing assets in user wallets were affected.

The Cysic Foundation suspended its cross-chain bridges after identifying a vulnerability in the message-processing and token-minting flow. The foundation said the incident was limited to the bridge infrastructure and did not affect the Cysic mainnet's consensus mechanism, transaction execution or tokens already held by users.

— Cysic Foundation (@cysic_fdn) October 18, 2026

— Cysic Foundation (@cysic_fdn) October 18, 2026

Unauthorized CYS minting on BNB Smart Chain

The source report gives two timestamps for the unauthorized mint on BNB Smart Chain: 12:31:38 UTC on Oct. 17, 2026, and 17:31:38 UTC on the same date.

According to Cysic's preliminary investigation, the attacker gained access to a database used by a service supporting the bridge. The attacker then exploited a vulnerability in the associated processing logic to send a fraudulent mint message, resulting in the creation of 10 million CYS at a single recipient address. The attack path — compromised database access on a supporting service followed by a fraudulent mint message — illustrates that bridge security extends beyond on-chain contracts to the off-chain infrastructure that feeds them.

Cysic cautioned that the number of newly created tokens should not be treated as the final measure of the incident. The actual dollar impact, along with any transfers and swaps, remained under investigation. Because the tokens were minted rather than drained from user wallets, the realized impact hinges on whether the new supply is moved or swapped, a question the investigation had not yet resolved.

Approximately 2.8 million CYS restricted

Cysic began adding the recipient address to the CYS token contract's blacklist at 13:47:52 UTC, approximately 76 minutes after the unauthorized mint. The restriction was activated on-chain and was preventing transfers of about 2.8 million CYS still held at the address. A contract-level blacklist can stop tokens from leaving an address, but it does not by itself recover them, which is why tracing work continued alongside the freeze.

The team was also tracking an additional $3,380.41 with assistance from a professional security firm, according to the report.

Mainnet and existing user assets unaffected

Cysic said the incident did not compromise the mainnet's infrastructure. Consensus, block production, transaction confirmation and Ethereum Virtual Machine execution remained unaffected.

The foundation also said there was no evidence that existing CYS or other assets had been stolen from user wallets. Unlike an exploit that drains assets held by users, this incident involved the unauthorized creation of new tokens at a recipient address.

Bridge remains suspended during review

Cysic suspended bridge operations immediately after detecting the incident and said the service would not be restored until the full workflow had been reviewed. The investigation covers message handling, permission settings, asset records and the complete attack path.

The foundation has not announced a reopening date. The bridge will remain closed until the security assessment is complete and the recommended remediation has been verified, leaving cross-chain transfers through Cysic's bridges unavailable in the meantime.

Cysic said it would issue a follow-up report covering the investigation's findings, actual losses, progress in tracing the funds and the final remediation steps. Those findings, together with any confirmed movement of the minted tokens, will define the incident's final scope.

Primary source: CryptoNinjas

Official post: https://x.com/cysic_fdn/status/2111761749116637687?ref_src=twsrc%5Etfw