Cysic has suspended its cross-chain bridge following the unauthorized minting of 10 million CYS tokens on BNB Smart Chain on October , 2026.

The company characterized the incident as confined to bridge message processing and minting functions, stating that the mainnet and its other operational systems remain unaffected. The bridge itself, however, is offline indefinitely, with no timeline provided for its restoration.

What happened on the bridge

Cross-chain bridges typically verify a transfer on one chain and mint a corresponding representation of the asset on another, which is why compromise of message processing and minting functions can lead to tokens being created without a matching deposit on the source chain.

The unauthorized mint took place at 12:31:38 UTC on October 17. By 13:47:52 UTC that same day, Cysic had blacklisted the address that received the tokens.

At the time of blacklisting, approximately 2.8 million of the newly minted CYS remained in that address — meaning the majority of the 10 million tokens had already left the wallet before the freeze took effect.

Cysic has engaged third-party security experts to investigate the breach. The team is also tracking the movement of the exploited tokens and monitoring whether they get swapped.

Early findings point to a potential link between the breach and unauthorized database access, along with weaknesses in the bridge's processing logic. The company has not confirmed the full attack vector or the root cause; both remain under evaluation.

A recurring failure mode

Bridge-based mint exploits are not a new phenomenon. Syscoin suffered a similar bridge mint exploit in June 2026, and incidents of this kind continue to expose the same core weakness: minting functions without sufficiently strong safeguards around them.

The supply context underscores the significance of the event. CYS has a maximum supply of 1 billion tokens, of which around 160.8 million were in circulation following the token generation event. Measured against that circulating figure, 10 million unauthorized tokens represent a meaningful addition to supply.

Cysic's road to this point

Cysic operates a dual-token model. CYS serves as the utility token, while CGT handles governance and is obtained through staking. The bridge incident involved CYS only; Cysic has reported no impact on CGT.

The project launched its mainnet and conducted the CYS token generation event in December 2025, following a funding round and a series of testnets. The launch drew criticism over how TGE tokens were distributed and over financial transparency.

The October breach is the first notable operational security problem tied to Cysic's bridge infrastructure.

What this means for CYS holders and bridge users

For holders, the immediate issue is dilution. Ten million tokens were created outside the intended process, and only approximately 2.8 million of them are confirmed frozen.

Bridge users, meanwhile, cannot move CYS across chains through Cysic's bridge until it reopens, and no date for that has been given.

The investigation's early direction also warrants attention. A confirmed link to unauthorized database access would suggest the weakness may have resided in off-chain systems feeding the bridge, rather than solely in smart contract code. If so, it would broaden the security conversation beyond audits of on-chain contracts to cover how bridge operators protect their own back-end systems.

In the near term, three developments will shape how the situation evolves: whether the investigation confirms the attack vector and root cause, what happens to the roughly 7.2 million tokens that left the blacklisted address before the freeze, and when — or on what terms — Cysic restores bridge service.