Cysic has suspended related bridge services and opened an investigation after an attacker minted 10 million CYS tokens without authorization on BNB Chain on October 17. The project’s foundation said the incident stemmed from a compromise affecting systems used to support the bridge rather than the broader network itself.

According to the foundation, the attacker sold most of the newly minted tokens and moved the proceeds to Ethereum. Cysic said the bridge will remain offline while security checks continue, and the full scale of the damage is still being assessed.

How the exploit was carried out

The foundation said the attacker obtained unauthorized access to the database of a service that supports bridge operations. That access was then used together with a flaw in the bridge’s message-processing system to submit fraudulent token-minting requests.

Because those requests bypassed normal approval steps, the attacker was able to mint a large amount of CYS on BNB Chain. Cysic described the issue as limited to the bridge’s message-processing and token-minting functions.

Token sales and fund movements

On-chain records cited in the report show that 7.2 million of the illicitly minted CYS were sold in a series of transactions. Of that amount, 5.65 million CYS was converted into about 588,315 USDT, while another 1.55 million CYS was exchanged for roughly 220 BNB.

The proceeds were then moved through cross-chain protocols to Ethereum, where they amounted to about 306.6 ETH. The source article valued that total at roughly $727,000 at the time of the transfers. It added that most of the Ethereum was later sent on to a separate wallet.

Cysic response and containment

Cysic said it blacklisted the attacker’s address around 76 minutes after the initial attack. That action blocked transfers of the remaining 2.8 million CYS still on BNB Chain.

The blacklist did not affect funds that had already been bridged out to Ethereum. Alongside the freeze, the project suspended related services and said it had engaged an external security firm to investigate the breach and trace the moved assets.

What was and was not affected

The foundation said the incident did not impact the Cysic mainnet or existing user assets. Its statement framed the breach as isolated to the bridge component responsible for processing messages and minting tokens tied to cross-chain activity.

For now, the next confirmed step is the ongoing outside investigation and the completion of security checks before the bridge is brought back online. Cysic, which is developing hardware for zero-knowledge proofs as well as a layer-1 blockchain network, has not yet given a final estimate of the damage.

Source: en.bloomingbit.io