Cysic Bridge Exploited: Attacker Mints 10M CYS Tokens on BNB Smart Chain

Cysic, a cross-chain compute network, suspended its bridge on Saturday after an attacker exploited a processing flaw to unauthorized mint 10 million CYS tokens on BNB Smart Chain. The mint occurred at 12:31:38 UTC, according to a Sunday X incident report from the project. Cysic added the recipient address to the token contract's blacklist at 13:47:52 UTC, with approximately 2.8 million CYS remaining at that address and transfers restricted.

The company stated that preliminary findings point to unauthorized access to a database supporting the bridge's message processing. Cysic emphasized that the incident was limited to bridge message processing and minting operations, and did not affect the mainnet or other operational systems. "The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets," the company said in its statement.

CYS coordinates incentives for users, compute providers, governance participants, and contributors within Cysic's network, according to the project's tokenomics documentation. Cysic noted that the 10 million token mint size alone does not establish the dollar impact of the incident, as token transfers, swaps, and actual losses remain under review. The company has engaged a third-party security firm to conduct a full investigation.

Cysic plans to publish a follow-up report once the current investigation phase concludes. The exploit comes amid a challenging quarter for crypto security, with multiple bridge and exchange incidents pushing Q3 crypto hack losses toward $1.2 billion. Bridge vulnerabilities have remained a persistent attack vector in the crypto industry, drawing renewed scrutiny from developers and auditors alike.