Cysic Bridge Exploited: Attacker Mints 10M CYS Tokens on BNB Chain

The Cysic Foundation suspended its cross-chain bridge on Saturday after an attacker exploited a processing flaw to mint 10 million unauthorized CYS tokens on BNB Smart Chain. According to a Sunday X incident report from the foundation, preliminary analysis indicates the attacker gained unauthorized access to a database supporting the bridge infrastructure. Cysic said the incident was confined to bridge message processing and minting, and did not affect the mainnet or other operational systems.

The unauthorized issuance occurred at 12:31:38 UTC on October 17, 2026. Cysic responded by blacklisting the recipient address on the token contract at 13:47:52 UTC, roughly 76 minutes later. Approximately 2.8 million CYS remained at that address with transfers restricted following the blacklisting action. The foundation emphasized that no existing CYS tokens or other assets held in user wallets were stolen or transferred without authorization during the incident.

CYS serves as the coordination token for incentives across Cysic's network, rewarding users, compute providers, governance participants, and contributors according to the project's tokenomics documentation. There are approximately 160.8 million CYS tokens currently in circulation, according to CoinMarketCap data. Cysic noted that the 10 million token mint alone does not establish the dollar impact, as token transfers, swaps, and actual losses remain under active review.

The Cysic Foundation has engaged an unnamed third-party security firm to assist with the investigation and plans to publish a comprehensive follow-up report after completing the current investigative phase. The incident adds to a growing list of crypto bridge and exchange exploits in 2026, with Q3 figures already approaching $1.2 billion according to industry tracking.