Cysic has suspended its cross-chain bridge after an attacker exploited a vulnerability that allowed 10 million CYS tokens to be minted without authorization on BNB Smart Chain. The attacker managed toCysic has suspended its cross-chain bridge after an attacker exploited a vulnerability that allowed 10 million CYS tokens to be minted without authorization on BNB Smart Chain. The attacker managed to

Cysic Bridge Exploit Drains $727K as Attacker Mints Millions of CYS Tokens

#行业观察

2026/10/19 17:47

Cysic has suspended its cross-chain bridge after an attacker exploited a vulnerability that allowed 10 million CYS tokens to be minted without authorization on BNB Smart Chain. The attacker managed to sell 7.2 million of the newly created tokens and move approximately $727,000 in proceeds to Ethereum before Cysic blacklisted the receiving address.

The incident has raised fresh concerns around the security of cross-chain infrastructure, particularly systems responsible for processing messages and authorizing token issuance. Cysic said the breach was limited to its bridge's message-processing and minting functions and that its mainnet and existing user assets were not affected.

1.How the Cysic Bridge Exploit Happened

According to Cysic's preliminary investigation, the attacker gained unauthorized access to a database used by services supporting the cross-chain bridge. A vulnerability in the bridge's processing logic was then exploited to submit a fraudulent message that triggered the minting of CYS tokens on BNB Smart Chain.

The unauthorized mint was recorded at approximately 12:31 UTC on October 17. Rather than representing tokens backed by an equivalent transfer from another network, the newly created CYS was issued through the compromised bridge process.

Cysic has not yet disclosed the complete attack path or final root cause. The project said it has brought in an external security firm to investigate the incident, trace the movement of funds and determine how the bridge's security was bypassed.

2.Attacker Sold 7.2 Million CYS Tokens

The attacker moved quickly after the unauthorized mint. On-chain data showed that approximately 7.2 million of the 10 million minted CYS tokens were sold through a series of transactions before Cysic was able to blacklist the receiving address.

Around 5.65 million CYS were exchanged for approximately 588,315 USDT, while another 1.55 million tokens were sold for roughly 220 BNB. The proceeds were subsequently moved away from BNB Smart Chain through cross-chain services.

The transactions ultimately resulted in roughly 306.6 ETH being transferred to Ethereum. At the time, those assets were valued at approximately $727,000.

3.Cysic Freezes Remaining CYS

Cysic responded by suspending its cross-chain bridge and blacklisting the attacker's receiving address. The address was frozen approximately 76 minutes after the unauthorized mint occurred.

By that point, approximately 2.8 million CYS tokens remained at the attacker's address. Those tokens were subsequently restricted from being transferred on BNB Smart Chain.

However, the blacklist could not reverse assets that had already been moved away from the affected chain. The ETH transferred to Ethereum was therefore outside the scope of the CYS blacklist, leaving the project's security team to trace the funds separately.

4.User Assets and Cysic Mainnet Remain Unaffected

One of the more important details from Cysic's response is that the incident did not involve the theft of assets held in users' wallets.

The Cysic Foundation said the attack was confined to the bridge's message-processing and token-minting functionality. The project's mainnet and other operational systems were not affected, according to its preliminary findings.

That distinction is significant because an exploit allowing unauthorized token creation is different from an attack that directly drains users' deposited assets. In this case, the primary issue was the bridge's ability to authorize and create tokens without the required legitimate transaction behind them.

5.Why Cross-Chain Bridges Remain a Security Risk

The Cysic incident once again highlights the risks associated with cross-chain bridges. These systems are designed to move assets or information between separate blockchain networks, but that functionality requires additional layers of verification and message processing.

A vulnerability in those layers can have significant consequences. If an attacker manages to bypass the checks responsible for validating a cross-chain transaction, they may be able to trigger actions that were never legitimately authorized.

For Cysic, the exploited weakness appears to have been tied specifically to how bridge messages were processed and how minting requests were authorized. The project has not yet released a complete post-mortem, so the precise technical mechanism behind the breach remains under investigation.

Conclusion

The Cysic bridge exploit demonstrates how a vulnerability in cross-chain infrastructure can quickly turn into a significant token-security incident. An attacker was able to mint 10 million CYS on BNB Smart Chain, sell 7.2 million of those tokens and move roughly $727,000 in proceeds to Ethereum before the compromised address was blacklisted.

While Cysic says its mainnet and existing user assets were not affected, the incident puts the security of its bridge under close scrutiny. With the bridge suspended and an external investigation underway, the project's next steps in identifying the root cause and strengthening its cross-chain security will be closely watched by the broader crypto community.

Disclaimer: This article is for informational purposes only and should not be considered as financial or investment advice. Cryptocurrency markets are highly volatile and involve significant risk. Readers should do their own research before making any financial decisions .

市场机遇

Cysic实时价格 (CYS)

$0.1158

$0.1158$0.1158

USD

Cysic (CYS) 实时价格图表

本页面分享的文章均源自公开平台，仅供参考。该内容不代表 MEXC 的立场或观点。所有版权归 Mubashir 所有。如果您认为任何内容侵犯了第三方的权益，请联系 service@support.mexc.com 以便及时删除。 MEXC 不保证任何内容的准确性、完整性或及时性，且不对基于所提供信息而采取的任何行动负责。本内容不构成财务、法律或其他专业建议，亦不应被解释为 MEXC 的推荐或认可。如需专家见解和深入分析，请造访 MEXC 学院。