Cysic has halted its cross-chain bridge after an attacker reportedly created 10 million CYS tokens without authorization on BNB Smart Chain on Oct. 17. The project said the incident stemmed from unauthorized access to a database that supported bridge operations, followed by the submission of fraudulent minting messages.
In a statement released on Oct. 18, the Cysic Foundation said the breach was limited to bridge-related infrastructure in its preliminary assessment. It added that the project’s mainnet was not affected and that existing customer wallet assets were not stolen, while investigators continue to track where the newly minted tokens moved and what losses may have resulted.
Attack timeline points to bridge message abuse
According to the incident timeline shared by the project, the unauthorized mint on BNB Smart Chain was recorded at 12:31:38 UTC on Oct. 17. Cysic said early findings indicate the attacker gained access to a database used by the bridge and then exploited weaknesses in how bridge messages were processed.
The bridge is used to handle instructions tied to transfers across supported networks. In this case, the Foundation said those systems were manipulated to approve the creation of new CYS on BNB Smart Chain. Cysic described the affected areas as bridge message processing and minting, and said it has not identified a compromise of the underlying Cysic mainnet.
The project has not yet disclosed how the database was accessed, the exact code flaw involved, or the full transaction sequence behind the unauthorized issuance. No independent forensic report accompanied the initial announcement, and the technical conclusions released so far remain preliminary.
Bridge suspended and wallet blacklisted
After detecting the incident, Cysic suspended bridge operations to stop further activity through the affected service. The team also identified a recipient wallet linked to the unauthorized tokens and later blocked transfers from that address through the token contract’s blacklist function.
Cysic said the address was blacklisted at 13:47:52 UTC on Oct. 17, which was 1 hour, 16 minutes and 14 seconds after the reported mint. About 2.8 million CYS remained in that wallet at the time, meaning roughly 28% of the 10 million unauthorized tokens had been immobilized there.
That leaves 7.2 million CYS outside the balance held by the blacklisted address, but the project has not said how much of that amount was sold, moved to other wallets, swapped, or otherwise recovered. The Foundation said investigators are tracing token transfers and reviewing possible swaps before giving a fuller accounting of the financial impact.
No confirmed loss figure yet
Cysic has not published a verified total for the proceeds allegedly obtained by the attacker, nor has it released a complete list of recipient addresses. The Foundation also has not provided an independent valuation of assets that may have left the affected system.
The project’s disclosures make clear that the 10 million CYS mint should not automatically be treated as a confirmed dollar loss. A token issuance amount can indicate the scale of unauthorized creation, but it does not by itself show how much value could actually be sold or withdrawn given market liquidity and subsequent tracing results.
As of the initial update, Cysic had not reported a completed recovery of any tokens beyond the 2.8 million CYS frozen at the blacklisted address.
Mainnet unaffected as outside review continues
In its initial assessment, the Foundation said the breach did not extend beyond the cross-chain bridge infrastructure. It said Cysic mainnet operations and other operational systems remained unaffected, and it reported no unauthorized removal of existing CYS balances or other assets from customer wallets.
Cysic has engaged an external security company to examine the incident, including the attack path, the systems involved, and the movement of the newly minted tokens. The project said it plans to release another public security report after that review is completed.
For now, the bridge remains suspended, and no date has been announced for service restoration. The next confirmed step is the publication of Cysic’s follow-up findings once the ongoing investigation is finished.
Source: crypto.news