Cysic Foundation said an attacker exploited its cross-chain bridge on Oct. 17 to mint 10 million unauthorized CYS tokens on BNB Chain, then sold roughly 7.2 million of them before the affected address was blacklisted. The breach created tokens equal to 1% of CYS’s fixed 1 billion-token supply without corresponding assets being locked or burned on Cysic’s source network.
The foundation paused the bridge after detecting the incident and said the Cysic mainnet was unaffected. It also said the attack did not directly remove assets already held in users’ wallets, although the unauthorized supply reached secondary markets and was converted into other crypto assets within less than an hour.
On-chain records cited in the incident account show the first unauthorized mint occurred at 20:31:38 Beijing time. Selling started around five minutes later, giving the attacker a short but sufficient window to exchange most of the minted tokens before restrictions took effect.
Tokens were sold before blacklist action
Between 20:36 and 20:41 Beijing time, the attacker sold 5.65 million CYS in 11 transactions, receiving about 588,300 USDT, according to the on-chain transaction history. A second selling sequence followed from 20:57 to 20:59, when another 1.55 million CYS was exchanged across four transactions for roughly 220 BNB.
Together, those transactions account for about 7.2 million CYS, or 72% of the unauthorized mint. By the time the foundation added the receiving wallet to the CYS token contract blacklist at 21:47:52, the address retained about 2.8 million CYS. That was 28% of the illicitly created amount, leaving most of the supply already sold or moved through subsequent transactions.
Twelve of the 15 sale transactions were routed through the OKX DEX aggregator, according to the transaction records, with orders divided among decentralized liquidity venues including PancakeSwap. Splitting trades can make a large disposal easier to execute by accessing liquidity across several pools rather than relying on a single market.
The attacker then moved proceeds across chains using SWFT, Mayan and deBridge. The transfers ultimately delivered about 306.6 ETH to Ethereum, valued at approximately $727,000 at the time cited in the on-chain analysis. Those ETH were later forwarded to a separate wallet.
The sequence places the attack’s practical impact beyond the initial unauthorized mint. Once CYS had been swapped into USDT, BNB and eventually ETH, the foundation’s ability to freeze CYS at the original address could no longer affect the converted proceeds.
Database access and a forged bridge message
In its preliminary findings, Cysic Foundation said the attacker obtained access to a database associated with bridge operations and exploited a flaw in the bridge’s message-processing logic. The vulnerability allowed a forged instruction to trigger minting on BNB Chain.
A cross-chain bridge normally relies on a verified message showing that tokens have been locked, burned or otherwise accounted for on the originating chain before equivalent assets are minted or released on another network. In this case, Cysic said the forged instruction bypassed that relationship, enabling CYS to be created on BNB Chain without matching collateral on the source side.
The foundation has not yet explained how the database access was obtained, which component accepted the forged message, or why its validation controls did not block the transaction. It said a fuller incident report is pending.
Those unanswered technical details will determine whether the weakness was limited to a particular operational environment or reflects a broader issue in the bridge’s architecture. The foundation’s immediate decision to halt the bridge suggests it is treating the message flow as compromised until the affected controls can be reviewed.
A bridge built for CYS transfers
The suspended service was designed to move CYS between the Cysic mainnet and other networks, including BNB Chain. Such bridges can expand a token’s availability across decentralized applications and liquidity pools, but they also depend on software and operational systems that must accurately coordinate balances across separate blockchains.
Cysic was founded in 2022 and initially focused on hardware acceleration for zero-knowledge proof generation. It later expanded into decentralized computing, including workloads related to zero-knowledge proofs and AI inference. The project has announced $18 million in funding across two rounds: a $6 million seed round announced on Feb. 17, 2023, and a $12 million pre-A round announced on May 24, 2024.
The CYS event follows several bridge-related security incidents reported this year. KelpDAO was linked to a bridging event involving roughly $292 million, while Verus reported bridge attacks of about $11.58 million in May and $7.54 million in July. Across and Wanchain also recorded incidents valued at around $4.5 million and $9.3 million, respectively. Those five cases totaled more than $323 million before any potential recoveries.
DefiLlama data cited in the supplied incident material recorded 250 hacking events during 2026, with about $1.4 billion lost across digital-asset platforms before the autumn period. Bridge incidents remain especially damaging when an attacker can turn an unbacked token mint into liquid assets and move proceeds through several networks before a protocol can intervene.
For Cysic, the immediate issue is no longer confined to the 2.8 million CYS frozen at the blacklisted address. The foundation must establish whether it can contain the unauthorized supply already sold into markets, trace the ETH moved to Ethereum, and rebuild the bridge’s verification process before transfers between its mainnet and external chains resume.
Bridge exploits are rising—discover key lessons from past hacks in this crypto security breaches guide to protect your assets.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
