Cysic has suspended its cross-chain bridge after an attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain on October 17, 2026. According to figures cited by the company, the attacker sold roughly 7.2 million of the newly created tokens and moved about 306.6 ETH, valued at approximately $727,000, to Ethereum before the remaining 2.8 million CYS were frozen. Cysic said the incident had no impact on its mainnet or on the assets of existing users.

Attackers Exploit Bridge Message-Processing System

The attacker took advantage of vulnerabilities in the bridge's message-processing system, according to an incident report posted on X by the Cysic Foundation. Initial findings indicate unauthorized access to a database that supports the bridge's operation, though investigators have not yet verified the full attack technique.

Cross-chain bridges relay assets and messages between otherwise separate blockchains, and past industry exploits have frequently focused on the components that verify and pass those messages rather than on the chains themselves. That architecture also explains the separation Cysic described: a bridge built on its own message-processing and database layer can fail without touching block production, transaction confirmation, or EVM execution on the mainnet.

Cysic confirmed the breach and its emergency response in a statement on X:

On Oct 17, a security incident involving the unauthorized minting of 10M CYS occurred through the Cysic bridge. Our team responded swiftly. User wallets and mainnet operations remain unaffected. The bridge remains suspended pending security review. Full update below. 👇

— Cysic (@cysic_xyz) October 18, 2026

The attack was carried out on October 17 at 12:31:38 UTC, resulting in 10 million additional CYS tokens on BNB Smart Chain that had never been authorized. The foundation described the event as an isolated bridge security failure.

Cysic stated that the incident had no effect on its mainnet operations. The compromised bridge system did not interfere with block production, transaction confirmation, or EVM transaction execution, and there was no theft or unauthorized transfer of existing assets from user wallets, according to the foundation.

The unauthorized token creation did, however, allow the attacker to sell the freshly minted CYS on the open market. The attacker reportedly offloaded around 7.2 million tokens within 23 minutes, an episode that has drawn renewed attention to the security of cross-chain bridges and the risks posed by unauthorized token issuance.

The attacker also sent approximately $727,000 in ETH — roughly 306.6 ETH — to Ethereum. The attacker reportedly used SWFT's Bridgers, deBridge, and Mayan to move the money. However, the team is still working to reconstruct the complete transaction history and to determine whether any further recovery of the proceeds is possible.

Remaining Tokens Frozen and Bridge Kept Offline

In response to the breach, Cysic suspended its cross-chain bridge and restricted the attacker's wallet address. The foundation also hired a professional security company to investigate the incident and trace the flow of funds. The bridge remains closed in the meantime as the team reviews its security systems.

According to the reported incident timeline, Cysic blacklisted the recipient wallet address at 13:47:52 UTC, just over an hour after the unauthorized minting took place. The remaining 2.8 million CYS tokens were subsequently "frozen," meaning no further transfers of those tokens could be made from the restricted address.

Although the attacker had already sold millions of tokens by that point, the response was able to contain the incident. The foundation has not yet established the final financial impact of the unauthorized minting, and the number of tokens produced does not necessarily reflect their dollar value or the magnitude of actual losses.

Cysic also emphasized an important distinction: newly minted tokens are not the same as tokens stolen out of existing wallets. The company reiterated that the incident did not affect user wallets or its mainnet, but users should wait for official updates before attempting any cross-chain transactions.

The foundation has not yet said when it will resume bridge services. The suspension will remain in place as a precaution until investigators determine how the vulnerability was exploited and how the supporting database was accessed. Cysic's next updates are expected to explain the cause of the outage, the remediation steps underway, and the conditions that must be met to restore service.

With the frozen 2.8 million CYS still tied to the blacklisted address, the fund-tracing work remains the main thread to follow, alongside the pending verification of the full attack technique and any decision on when the bridge can resume operations.

For now, the incident underscores the security risks associated with cross-chain bridges and their message-processing systems. Cysic has restricted the affected address, but the investigation continues.

This article is based on reporting by Live Bitcoin News.