Skip to content
Blockchain Posts

exploit

Cysic halts BNB-chain bridge after unauthorized 10M CYS mint

Cysic says 10M CYS were minted on BNB Smart Chain at 12:31 UTC on October 17; the bridge is offline indefinitely and most of the tokens left the recipient address before blacklisting.

by 3 min read
exploitcysicbnbbridgeinfrastructure

Cysic said an unauthorised actor minted 10 million CYS on BNB Smart Chain on October 17 and used its own bridge to produce them, per coverage in The Defiant and Crypto Briefing. The mint fired at 12:31:38 UTC; the recipient address was blacklisted at 13:47:52 UTC, roughly 76 minutes later. The bridge is now offline indefinitely.

What happened

  • The 10M CYS were minted on BNB Smart Chain. No tx hash has been published by the team or the two outlets.
  • The recipient address held about 2.8M CYS at the time it was blacklisted. "Most of the 10 million tokens were no longer in the frozen wallet," per Crypto Briefing — the remainder had already moved before enforcement landed.
  • Cysic paraphrases the incident as limited to the bridge's message processing and minting path. Mainnet and other operational systems were not affected. There is no public tx hash list; the attacker address has not been named by Cysic.
  • The bridge is offline indefinitely. No restart timeline is given.

The team says early findings point to a possible link between unauthorised database access and weaknesses in the bridge's processing logic. Root cause and attack vector remain unconfirmed; third-party security experts have been brought in.

Supply impact

CYS has a maximum supply of 1,000,000,000 tokens, with roughly 160,800,000 in circulation after the token generation event, per Crypto Briefing. The 10M mint is therefore 1.0% of total supply and roughly 6.2% of the pre-event circulating float. The 2.8M frozen leaves at least ~7.2M CYS that moved before the blacklist took effect — assume unrecoverable until proven otherwise.

What to watch

  1. The attacker address and the mint tx hash on BNB Smart Chain. Both are checkable in seconds on BscScan once Cysic publishes them.
  2. Whether proceeds get routed through Tornado Cash Nova (BSC) or another mixer, or go directly to CEX deposit addresses.
  3. The post-mortem: specifically whether the "unauthorised database access" the team flagged is a signer-key leak or a bridge-relayer approval bug. The distinction decides whether competitor bridges on BSC need to review the same code path.
  4. Any announcement of a CEX blacklist for the recipient address beyond Cysic's own token contract blacklist. Only the token-contract blacklist freezes CYS held at that address; an exchange blacklist is required to catch the holder on fiat ramps.

Context

Cysic positions itself as a decentralised compute network; the bridge moves CYS across chains. Crypto Briefing notes a similar bridge-mint incident at Syscoin in June 2026, where roughly five billion SYS were minted via a malformed SPV proof fed to the bridge relay. The bridge-relay path has been the single most expensive attack surface on EVM-chain cross-chain tokens for two years running, and the Cysic team's own early signal — "limited to bridge message processing and minting" — points to the same category of bug. Treat the incident as unresolved until a root-cause post-mortem lands.

Related stories