Cysic Bridge Exploit: Attacker Mints 10M CYS Tokens on BNB Smart Chain

The Cysic Foundation suspended its cross-chain bridge on Saturday after an attacker exploited a processing flaw to mint 10 million unauthorized CYS tokens on BNB Smart Chain. Preliminary findings point to unauthorized access to a database supporting the bridge infrastructure. The incident, which occurred at 12:31:38 UTC on October 17, was contained within approximately 76 minutes, with Cysic blacklisting the recipient address at 13:47:52 UTC.

Of the 10 million CYS minted, roughly 2.8 million remained at the flagged address with transfers frozen, leaving the remainder unaccounted for. With approximately 160.8 million CYS already in circulation according to CoinMarketCap data, the unauthorized tokens represent a significant dilution event. Cysic stated the incident was limited to bridge message processing and minting, emphasizing that the mainnet and other operational systems were not affected, and no existing user wallets or assets were compromised.

The foundation noted that the mint size alone does not determine the final dollar impact, as token transfers, swaps, and realized losses remain under active investigation. Cysic has engaged an unnamed security firm to conduct a full audit and plans to publish a follow-up report following the current investigation phase. CYS serves as the coordination token for incentives across Cysic's network, including compute providers, governance participants, and contributors, making the integrity of its bridge critical to the project's broader ecosystem.