Cysic has shut down its cross-chain bridge after an attacker created 10 million of its CYS tokens on BNB Smart Chain without authorisation. The Cysic Foundation says the attacker appears to have got into a database used by services supporting the bridge. It says existing tokens in users’ wallets were not stolen, and that the dollar cost of the incident is still being worked out.
What Cysic says happened
The Cysic Foundation set out the details in an incident report on X, published on Sunday 18 October at 10:10 UTC (11:10 UK time). “On October 17, 2026, the Cysic cross-chain bridge experienced a security incident involving the unauthorized minting of 10,000,000 CYS on BNB Smart Chain,” it says.
According to the report, “Preliminary findings indicate that the attacker gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message.” The tokens were minted at 12:31:38 UTC (13:31 UK time) on Saturday 17 October. “The full attack path and root cause remain under investigation,” Cysic says.
At 13:47:52 UTC (14:47 UK time), about 76 minutes after the mint, Cysic added the receiving address to a blacklist in the CYS token contract on BNB Smart Chain. That restricts transfers from the address. According to the report, “the approximately 2.8 million CYS currently remaining at that address” can no longer be moved.
By TSN’s arithmetic, that suggests roughly 7.2 million of the newly minted tokens had left the address by then, though Cysic has not given that figure itself. Cysic says “the subsequent transfers and swaps of these tokens, as well as the actual losses arising from the incident, remain under review.” The Defiant reports that “onchain records show some tokens were sold before the blacklist took effect.” Neither has said how many.
What was and wasn’t affected
Cysic says this “was an isolated security incident confined to the cross-chain bridge’s message processing and minting functions”. It says the Cysic mainnet was not affected, including “mainnet consensus, block production, transaction confirmation, or EVM transaction execution”.
On user funds, the report says: “The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets.”
Cysic stresses that the headline figure is not a loss figure. “The number of tokens minted does not, by itself, represent the final loss in U.S. dollar terms,” it says. Cointelegraph also notes that, according to Cysic, the mint size alone does not establish the incident’s dollar impact. TSN is not giving a value for the tokens.
What a bridge mint flaw means
A cross-chain bridge lets a token move between two separate blockchains. Many bridges work by receiving a message that a token has been locked or sent on one chain, then minting, or creating, a matching token on the other. That step relies on the bridge only acting on genuine messages.
Cysic says that is where its bridge failed. According to its report, the attacker submitted “a fraudulent mint message”, which caused the bridge to create 10 million new CYS on BNB Smart Chain that were not backed by a real transfer. Cysic says the attacker first reached a database used by services behind the bridge, then exploited a weakness in the processing logic. Cysic has not said exactly how either step worked.
CYS “coordinates incentives for users, compute providers, governance participants and contributors in Cysic’s network, according to the project’s tokenomics documentation”, Cointelegraph reports.
What Cysic is doing now
Cysic says it suspended the bridge, blacklisted the receiving address and “engaged a professional security firm to investigate the attack path, the addresses involved, and the flow of funds”. It has not named the firm. It is also reviewing “message processing, permission configurations, and related asset records”.
“The cross-chain bridge remains closed and will reopen only after the security review has been completed,” the report says. Cysic plans a follow-up report setting out “the verified impact of the incident, actual losses, progress in tracing funds, and the results of remediation and validation”.
A warning about scams
Cysic is warning users about scams that use the incident as cover. It says it “will never ask for your seed phrase or private key via direct message, nor will we ask you to transfer assets to a so-called ‘safe account.'” It also tells users: “Do not open compensation, refund, or asset recovery links from unverified sources.”
What we don’t know
- How many of the 10 million CYS were sold or moved before the blacklist.
- The actual losses, in tokens or dollars.
- How the attacker got into the database, and who was responsible.
- When the bridge will reopen.
What this means
- Cysic says an attacker minted 10 million CYS on BNB Smart Chain through its bridge on 17 October, after apparently gaining access to a database behind it.
- About 2.8 million of those tokens are frozen. Some of the rest were sold before the freeze, The Defiant reports.
- Cysic says user wallets and its mainnet were not affected. Losses are not yet known, and the bridge stays closed until a security review is finished.
Sources
- Cysic Foundation on X: Cysic Incident Report, 18 October 2026
- Cointelegraph: Cysic crypto bridge halted after unauthorized mint of 10M CYS
- The Defiant: Cysic halts bridge after unauthorized mint of 10 million CYS
Related stories
- Hacken Says Crypto Hacks Cost $1.18 Billion in Q3 2026, Mostly Through Suppliers, Developer Tools and Unpatched Fixes
- Base vault ~$6m loss: whitelist change, not an Aave core breach
- OpenCode Says Breach Tied to ‘Distillation Attack’ Hit 1.4% of Console Users
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
