Cysic has suspended its cross-chain bridge after an attacker exploited its message-processing infrastructure to mint 10 million unauthorized CYS tokens on BNB Smart Chain, selling 7.2 million of them and moving approximately $727,000 in proceeds to Ethereum.

The October 17 incident stemmed from unauthorized database access and fraudulent minting instructions. Cysic blacklisted the recipient's address, immobilizing the remaining 2.8 million tokens roughly 76 minutes after the unauthorized issuance.

The Foundation confirmed in a statement on X that the incident was confined to bridge infrastructure. Cysic mainnet operations were unaffected, and no existing user wallet assets were stolen.

Database Breach Enabled Unauthorized CYS Minting

The attack began at 12:31:38 UTC on October 17, when an unauthorized minting transaction created the additional CYS supply on BNB Smart Chain. Preliminary findings identified unauthorized access to a database supporting Cysic's cross-chain services. The attacker exploited a weakness in the bridge's message-processing logic to submit a fraudulent mint instruction that the system accepted.

The compromised infrastructure handled cross-chain messaging and token issuance rather than the underlying network's consensus operations. Bridges perform this verification-and-issuance role independently of the chains they connect, which is why a message-processing flaw can create unauthorized supply even when the underlying network and user-held assets remain intact. Cysic has engaged an external security firm to investigate the entry point, the processing vulnerability, and the subsequent movement of funds.

Cysic's security documentation lists bridge message verification, minting controls, and cross-chain asset integrity as previously audited components. The Foundation has not yet disclosed the complete technical attack path.

Attacker Sold 7.2 Million CYS Before Wallet Freeze

Onchain transaction tracking indicates the attacker began moving tokens within five minutes of the unauthorized mint. Approximately 5.65 million CYS were sold for 588,315 USDT in the first round of transactions. Another 1.55 million CYS were subsequently exchanged for roughly 220 BNB, with trades routed through decentralized exchange infrastructure, including PancakeSwap.

The proceeds moved from BNB Chain to Ethereum through Mayan, deBridge, and SWFT's Bridgers service. The receiving address accumulated approximately 306.6 ETH, valued at around $727,000 based on Ethereum prices on October 18.

Cysic blacklisted the attacker's CYS address at 13:47:52 UTC, a freeze measure that prevented further transfers of the remaining balance. The restriction did not affect the ETH already moved to Ethereum, where transaction tracking identified a subsequent transfer to another address.

The unauthorized issuance represented approximately 6.2% of the 160.8 million CYS circulating supply and 1% of the token's 1 billion total supply. The number of tokens created is separate from the attacker's realized proceeds, and Cysic has not established a final financial loss figure or recovered the bridged ETH.

Bridge Remains Suspended Pending Security Review

The exploit involved unauthorized token creation rather than a direct withdrawal from a bridge liquidity pool, making it a supply-integrity failure of the kind that affected the Sys bridge in June, when a validation flaw produced approximately 5 billion unauthorized SYS outputs. Comparable incidents illustrate the scale of the risk: in February 2022, a signature-verification flaw in the Wormhole bridge allowed the minting of 120,000 wrapped ETH without backing, then valued at more than $300 million, and the following month the Ronin bridge lost more than $600 million after attackers obtained a majority of its validator keys. Cross-chain bridges have repeatedly been targeted by attackers because they can create or move assets across multiple blockchain networks.

Cysic's cross-chain infrastructure remains suspended while investigators examine the compromised database, the fraudulent minting instructions, and the remaining attacker-controlled assets. The Foundation intends to release a follow-up incident report covering verified financial losses, fund tracing, and remediation measures. No reopening date for the bridge has been announced.