Cysic Suspends Bridge After Attacker Mints 10 Million CYS Tokens and Moves $727,000 to Ethereum
Cysic freezes bridge after unauthorized token mint
Cysic has suspended its cross-chain bridge after an attacker minted 10 million CYS tokens on BNB Chain on Saturday, the project confirmed. A bridge is a service that moves tokens between different blockchains.
The attacker sold 7.2 million of the unauthorized tokens and moved about $727,000 of the proceeds to Ethereum, according to onchain records reviewed by The Block. Onchain records are public transaction data stored on a blockchain.
The Cysic Foundation said it blacklisted the attacker's receiving address, which froze the remaining 2.8 million tokens, and closed the bridge while a security review is carried out.
Key numbers from the incident
- 10 million CYS tokens were minted without authorization on BNB Smart Chain.
- 7.2 million tokens were sold; 2.8 million were frozen by the blacklist.
- About 306.6 ETH, worth roughly $727,000, was bridged to Ethereum.
- The blacklist was applied at 9:47 a.m. ET, 76 minutes after the exploit transaction.
What the Cysic Foundation said
In an incident report posted to X on Sunday, the Cysic Foundation said the attacker "gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message."
The foundation said the issue was limited to the bridge's message-processing and minting functions and did not affect the Cysic mainnet. It said existing user assets were not stolen.
Cysic also said a security firm, which it did not name, is investigating and tracing the funds. The foundation said the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms," and it has not disclosed a dollar figure for its losses.
How the attacker moved the tokens
The unauthorized mint took place at 8:31 a.m. ET on Saturday, per onchain data. BscScan records show the receiving address began moving CYS five minutes later, sending out 7.2 million tokens in 26 transfers across 15 transactions by 8:59 a.m. ET.
The address sold the tokens in two rounds. Between 8:36 and 8:41 a.m. ET, it sold 5.65 million CYS in 11 transactions for a combined 588,315 USDT, or about 10 cents per token. Between 8:57 and 8:59 a.m. ET, it sold the remaining 1.55 million CYS in four transactions for about 220 BNB. USDT is a stablecoin, a token designed to keep a steady value tied to the U.S. dollar.
Twelve of the 15 transactions were routed through OKX's DEX aggregator, which split the orders across exchanges including PancakeSwap.
Funds bridged to Ethereum through three services
At 8:44 a.m. ET, the address sent 100,000 USDT to a BridgersSwap contract run by cross-chain swap service SWFT, and about a minute later received 40.88 ETH on Ethereum from a SWFT contract. It sent the remaining 488,315 USDT to cross-chain protocol Mayan in six transfers between 8:46 and 8:53 a.m. ET.
After the second round of sales, the address bridged its BNB as well, sending 80 BNB through Mayan at 9:05 a.m. ET and 139 BNB through deBridge a minute later.
On Ethereum, the address received seven payouts from Mayan totaling about 224.66 ETH and a 41.05 ETH payout from deBridge, with the last arriving at 9:06 a.m. ET, Etherscan records show. Including the SWFT transfer, the address received about 306.6 ETH, worth roughly $727,000 at Sunday's ETH price of about $2,372.
The address then sent 306.52 ETH in five transfers to a second wallet by 9:11 a.m. ET. That wallet, which first received funds about two hours before the mint, held about 309.5 ETH as of Sunday morning. Cysic's blacklist applies only to CYS on BNB Chain and does not affect the ether.
What is confirmed
Confirmed by the project and onchain records: an unauthorized mint of 10 million CYS tokens happened on BNB Smart Chain on Saturday; the attacker sold 7.2 million tokens; about 306.6 ETH (roughly $727,000) was bridged to Ethereum; and Cysic blacklisted the address, freezing 2.8 million tokens.
Confirmed by the Cysic Foundation: the bridge was suspended, the mainnet was not affected, and a security firm is investigating.
What is still unclear
Cysic has not named the security firm handling the investigation. It has also not disclosed a dollar figure for its losses, saying the number of tokens minted does not by itself equal the final loss in U.S. dollar terms. The identity of the attacker has not been established in the supplied material, and no recovery of the bridged funds has been reported. The Block said it reached out to Cysic and its PR representatives for comment.
Why the bridge stays closed
Cysic said the bridge will remain closed until a security review is complete. Because the bridge moves CYS and other tokens between the Cysic chain and networks such as BNB Smart Chain and Base, the closure stops that route while the review is under way.
The project said it will publish a follow-up report on verified losses and its efforts to trace the funds.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.