Cysic suspended its cross-chain bridge after an attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain and converted a large portion of them into assets later moved to Ethereum, according to the Cysic Foundation and onchain records from BscScan and Etherscan. The attacker ultimately received about 306.6 ETH, valued at roughly $727,000 using an ETH price near $2,372 on Sunday.
The incident centered on the bridge’s message-processing and minting functions rather than Cysic’s mainnet, the foundation said in an incident report posted on X. Cysic said an attacker gained unauthorized access to a database used by services supporting the bridge, then exploited a processing-logic weakness to submit a fraudulent mint message.
The bridge will remain offline until a security review is complete, the foundation said. Cysic has hired an unnamed security firm to investigate the intrusion and trace funds, and plans to publish another report covering verified losses and recovery efforts.
Unauthorized mint was followed by rapid sales
The unauthorized mint occurred at 8:31 a.m. ET on Saturday, according to BscScan data. About five minutes later, the receiving wallet began transferring CYS out of the address, selling or distributing 7.2 million tokens before its activity stopped at 8:59 a.m. ET.
The wallet sent the 7.2 million CYS through 26 transfers contained in 15 transactions. Sales were concentrated in two short periods, suggesting the attacker moved quickly to sell tokens before the issuer could block the address.
Between 8:36 a.m. and 8:41 a.m. ET, the wallet sold 5.65 million CYS across 11 transactions and received 588,315 USDT. That works out to roughly $0.10 per token based on the proceeds recorded onchain.
A second sale sequence took place from 8:57 a.m. to 8:59 a.m. ET. The attacker sold another 1.55 million CYS in four transactions for approximately 220 BNB. Twelve of the 15 sale transactions used OKX’s decentralized-exchange aggregator, according to BscScan transaction traces, which routed orders across liquidity venues including PancakeSwap.
Cysic blacklisted the address at 9:47 a.m. ET, 76 minutes after the unauthorized mint. The blacklist froze the 2.8 million CYS that remained in the wallet, but it arrived 48 minutes after the wallet had stopped distributing the tokens.
That timeline illustrates a familiar weakness in issuer-controlled token protections: blacklisting can prevent further transfers of identifiable tokens, yet it does not retrieve assets once an attacker has exchanged them for USDT, BNB, ETH, or other freely transferable assets.
Funds moved to Ethereum during the token sales
The attacker began bridging proceeds away from BNB Smart Chain before the CYS sales had finished. At 8:44 a.m. ET, the wallet sent 100,000 USDT to a BridgersSwap contract operated by SWFT, according to BscScan and Etherscan. Roughly one minute later, the related Ethereum address received 40.88 ETH.
The remaining 488,315 USDT was sent to the cross-chain protocol Mayan in six transfers between 8:46 a.m. and 8:53 a.m. ET. The sequence split the funds into smaller movements rather than routing the full amount through one bridge transaction.
After the second CYS sales round, the attacker also moved BNB off the network. The wallet sent 80 BNB through Mayan at 9:05 a.m. ET, followed about one minute later by a transfer of 139 BNB through deBridge.
On Ethereum, the address received seven payouts from Mayan totaling about 224.66 ETH and one payout from deBridge worth 41.05 ETH, according to Etherscan. Together with the 40.88 ETH received through SWFT, the address accumulated roughly 306.6 ETH by 9:06 a.m. ET.
By 9:11 a.m. ET, the attacker had sent 306.52 ETH in five transactions to a second Ethereum wallet. Etherscan records show that second wallet first received funds about two hours before the unauthorized mint and held roughly 309.5 ETH as of Sunday morning. Cysic’s blacklist only applied to CYS on BNB Smart Chain, leaving the swapped and bridged assets outside that token-level restriction.
Bridge design is under scrutiny
Cysic said the breach was limited to infrastructure that supported bridge message processing and minting. Its account indicates that the attacker did not compromise the Cysic mainnet itself, but was able to exploit an offchain service connected to the bridge’s authority to create tokens on another network.
That distinction matters for users of cross-chain systems. A bridge often has to verify that an asset was locked, burned, or otherwise authorized on one chain before it mints or releases a corresponding version on another. If the message-verification process can be manipulated, a bridge may issue tokens without the expected underlying collateral or authorization.
The Cysic case also shows how the consequences extend beyond the initially affected token. Once newly minted assets are sold through decentralized liquidity and bridged into native assets on another chain, freezing the original token can limit additional damage but cannot automatically reverse completed swaps or transfers.
Cysic, founded in 2022, develops specialized hardware and a Layer 1 network focused on generating zero-knowledge proofs. The company raised a $6 million seed round led by Polychain Capital in 2023. Its bridge supports transfers of tokens, including CYS, between the Cysic chain and networks such as BNB Smart Chain and Base.
The foundation has not published a final dollar estimate for losses. Its next report is expected to address the results of the security review, the tracing process, and any verified impact from the unauthorized mint.
Protect your funds after bridge exploits—learn key crypto safety standards every trader should know to reduce exchange and wallet risks.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
