Cysic has suspended its cross-chain bridge after an attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain and moved reported proceeds to Ethereum. The October 17 breach stemmed from faulty authentication of the bridge messages that authorize token issuance, according to the project's account of the incident.

Details of the unauthorized mint emerged in an October 18 incident report published by the Cysic Foundation. According to the report, the fraudulent mint took place at 12:31:38 UTC. Investigators traced the breach to unauthorized access to a bridge database. The attacker then exploited a message-processing vulnerability to submit fraudulent mint instructions without a corresponding asset transfer, causing the protocol to issue tokens with no underlying deposit to support them.

Initial on-chain activity cited in early reporting connected the incident to sales of 7.2 million tokens, with approximately 306.6 ETH received on Ethereum in return. Those proceeds were valued at roughly $727,000, although the foundation has not verified the complete transaction trail or determined the final losses.

How the Attacker Minted 10M CYS

Cross-chain bridges rely on authenticated messages to recognize transfers between blockchains and release matching assets. In this case, fraudulent instructions caused the system to mint tokens that lacked any legitimate transfer backing. The breach therefore centered on bridge message validation rather than a breakdown in the underlying network's consensus. Because a single accepted instruction can trigger issuance on the destination chain, this validation layer concentrates the trust of the whole bridge, and flaws at this point have been a recurring category of cross-chain security failures. The database access identified here also illustrates that bridge risk extends past on-chain code to the off-chain systems that feed it.

Cysic blacklisted the receiving address at 13:47:52 UTC, roughly 76 minutes after the mint. By that point, 2.8 million tokens — 28% of the issuance — remained in the blocked wallet, while the remaining 7.2 million, or 72%, had already moved out. Blacklisting immobilized the leftover balance but could not recover the funds that had already left the address. The project suspended its cross-chain bridge to prevent any further unauthorized activity.

An external security firm is now examining bridge messages, permissions, and asset records, while investigators trace the affected addresses. The bridge remains closed with no reopening date, pending completion of the security review and validation.

Unauthorized Mint Equals 1% of Total Supply

The scale of the issuance carries significance beyond the reported transfer proceeds. The project's tokenomics document a total supply of 1 billion CYS, allocated to governance, computing services, and network incentives. The 10 million unauthorized units equaled 1% of that stated supply, raising questions about unrecovered circulation until the probe concludes.

The amount transferred to Ethereum, however, should not be treated as a confirmed financial loss. Although initial tracking attributed 306.6 ETH to the attacker, the foundation has yet to establish how much was ultimately retained. Similarly, the 2.8 million restricted tokens represent a verified containment measure rather than evidence that any funds were recovered.

Mainnet operations were unaffected throughout the incident: consensus, block production, and transaction execution continued normally, and existing assets held in users' wallets remained intact. The project has also warned users against fake compensation links, recovery pitches, and requests for private keys.

A follow-up report is expected to address verified losses, fund tracing, and remediation — the findings that will shape any decision on reopening the bridge.