Cysic Halts Bridge After Unauthorized Mint of 10 Million CYS
Cysic has suspended its cross-chain bridge operations following an unauthorized mint of 10 million CYS tokens on the BNB Smart Chain due to a database vulnerability.
Following an incident on Saturday where an alleged attacker minted 10 million CYS on the BNB Smart Chain, Cysic suspended its cross-chain bridge operations on Sunday. Early indications suggest the security breach occurred due to a vulnerability in bridge processing stemming from unauthorized access to an underlying database.
Following the enforcement of transfer restrictions, approximately 2.8 million CYS were successfully frozen at the recipient’s address. However, reports from The Defiant indicate that a portion of the tokens had already been liquidated before the blacklist was activated, making the tracking of subsequent transfers and token swaps a primary focus of the ongoing inquiry.
CYS Blacklist Followed the Unauthorized Mint by About 76 Minutes
Data compiled by Cointelegraph shows that the unauthorized creation of tokens occurred at 12:31:38 UTC on Saturday, while Cysic applied the blacklist to the recipient address about 76 minutes later at 13:47:52 UTC.
By the time restrictions were applied, roughly 2.8 million CYS—accounting for about 28% of the newly minted supply—remained held at that address.
| Metric | CYS |
|---|---|
| Unauthorized mint | 10 million CYS |
| Tokens remaining frozen at recipient address | About 2.8 million CYS |
| Share of unauthorized mint remaining frozen | About 28% |
| Time from mint to blacklist | Roughly 76 minutes |
| Affected chain | BNB Smart Chain |
Cysic Bridge Exploit: Flaw Was Limited to Bridge Processing
In a statement released on Sunday, Cysic clarified that the vulnerability was confined to bridge message handling and minting functions, with preliminary assessments pointing to unauthorized database access as the entry point.
The company emphasized that its mainnet and other operational infrastructure remained secure, and user wallets did not experience any theft or unauthorized movement of existing tokens or assets.
Consequently, the immediate impact is restricted to the unauthorized supply generation and the shutdown of the bridge. The preliminary database findings are still subject to verification as security teams delve deeper into the incident.
CYS Sales Put Token Flows at the Center of the Investigation
Blockchain data highlighted by The Defiant reveals that certain sales were executed prior to the activation of the blacklist. As part of its remediation efforts, Cysic is actively reviewing token movements, swaps, and total financial losses.
For tokenholders, the primary concern is the market activity generated by the newly created assets before blocks were put in place. The ongoing audit aims to determine the full extent and financial cost of those transactions.
According to project documentation, CYS serves to align incentives across the network for users, compute providers, governance participants, and contributors. Because of this, the security breach impacts a core asset integrated throughout the ecosystem, rather than just affecting the bridge.
Cysic Hires Security Firm for Follow-Up Investigation
To assist with the response, Cysic has engaged an external security firm and intends to release a comprehensive report once the current investigative phase is complete. Initial insights center on the unauthorized minting event, bridge processing mechanisms, and database entry vectors.
Key developments for stakeholders to monitor include the tracking of pre-freeze token movements, the calculation of final losses, and the remediation of the processing vulnerability. These insights will ultimately determine the total financial fallout and the extent of required repairs.
This article is for information only and is not financial advice.
