Cysic Halts Bridge After 10 Million CYS Tokens Are Illegally Minted

In this news:

Key takeaways

Cysic halted its cross-chain bridge after 10 million CYS tokens were illegally minted.
The attacker exploited database access and message-processing vulnerabilities on BNB Smart Chain.
Cysic blacklisted an address holding about 2.8 million of the unauthorised tokens.

Cysic Investigates Bridge Database Access and Unauthorised Token Minting

The Cysic bridge was temporarily halted after reports that an intruder exploited a flaw in the process to create 10 million CYS tokens on BNB Smart Chain on October 17. In a statement on October 18, the Cysic Foundation said its initial investigation revealed unauthorised access to the bridge database and the submission of false minting messages. The company said it halted bridge operations and transfers from an address holding about 2.8 million CYS.

According to Cysic, the mainnet and other operational systems were not affected, although investigators were examining the token creation process. Cysic had yet to determine the financial losses resulting from the attack. Cysic's attack report distinguishes between the number of tokens minted and the amount of money that could have been obtained from completed transactions. The attack happened on October 17th, with the token-minting timestamp at 12:31:38 UTC.

Early results show that the hacker accessed a database used by the cross-chain bridge deployed by Cysic and exploited vulnerabilities in the bridge's message-processing system. In this case, the attacker reportedly abused the process to create permissions for creating CYS tokens via BNB Smart Chain. According to the Foundation's description, the affected mechanisms are bridge message processing and minting. There are no reports of an attack on the Cysic mainnet.

Address Blacklisting and Missing Token Balances

After detecting the attack, the team found an address where these unauthorised tokens were sent. On October 17 at 13:47:52 UTC, Cysic blacklisted this address in the token contract, thereby blocking its ability to transfer the tokens left there. The restriction occurred 1 hour, 16 minutes, and 14 seconds after minting. An estimated 2.8 million tokens were left at the listed address. In relation to the announced 10 million token issue, this would represent 28 percent of the unauthorised mint.

The remaining 7.2 million tokens were not part of the remaining balance above. The absence of those tokens from the restricted address says nothing about how many were sold, sent elsewhere, seized, or converted into other cryptocurrencies. As Cysic noted, the token transfers and exchange possibilities are being investigated for their consequences.

As per reports, crypto hacks have resulted in over $766 million roughly Rs. 7,376 crore worth of gross losses during September alone, marking the most expensive month in 2026 owing to Bitget and Liquid Network breaches. According to PeckShield, there have been 55 security breaches, with a total of around $766 million roughly Rs. 7,376 crore stolen, whereas according to CertiK, there were 97 security breaches, with $768.4 million roughly Rs. 7,399 crore lost.

Share the article: