Cysic suffered a cross-chain bridge security breach that allowed an attacker to create unauthorized tokens and move funds across networks.
The attacker sold most of the tokens before the project intervened. The delayed response allowed substantial proceeds to escape the affected network. Meanwhile, Cysic has suspended bridge operations as investigators assess the breach and trace the missing funds.
Cysic attacker mints 10 million CYS through bridge exploit
On October 17, an attacker exploited Cysic’s cross-chain bridge to mint 10 million unauthorized CYS tokens. The attacker subsequently sold 7.2 million CYS and transferred approximately $727,000 to Ethereum.
According to BscScan records, the fraudulent mint occurred on BNB Smart Chain at 12:31 UTC. However, Cysic blacklisted the receiving wallet at 13:47 UTC, leaving a 76-minute window.
Cysic Foundation incident report on the CYS blacklist, posted by @cysic_fdn on X on October 18, 2026.
The attacker completed token transfers 48 minutes before the blacklist took effect. Consequently, the restriction froze approximately 2.8 million CYS tokens remaining in the wallet.
CYS currently has approximately 160.8 million tokens in circulation.
Attacker converts 7.2 million CYS into USDT and BNB
BscScan records show the attacker conducted two selling rounds across decentralized exchanges.
The first round began at 12:36 UTC, converting 5.65 million CYS into 588,315 USDT within five minutes. Each token fetched approximately $0.10.
The second round occurred between 12:57 and 12:59 UTC. During that period, the attacker exchanged another 1.55 million CYS for approximately 220 BNB.
Twelve of the 15 transactions used OKX’s DEX aggregator, routing orders through several platforms, including PancakeSwap.
Meanwhile, the attacker began transferring proceeds across networks before completing the token sales.
SWFT’s Bridgers service processed 100,000 USDT at 12:44 UTC. Approximately one minute later, 40.88 ETH reached Ethereum.
Mayan subsequently received 488,315 USDT through six transfers by 12:53 UTC.
Following the second selling round, Mayan processed another 80 BNB at 13:05 UTC. DeBridge handled approximately 139 BNB one minute later.
Etherscan records indicate Mayan delivered approximately 224.66 ETH, while DeBridge transferred another 41.05 ETH.
Combined transfers reached approximately 306.6 ETH, worth $727,000 using Ethereum’s October 18 valuation of $2,372.
By 13:11 UTC, another wallet had received 306.52 ETH through five transactions. Its first deposit preceded the fraudulent mint by approximately two hours.
Cysic’s blacklist restrictions cannot freeze Ethereum holdings.
Cysic suspends bridge operations following security breach
In its October 18 incident report, the Cysic Foundation attributed the breach to unauthorized database access.
According to the foundation, the attacker exploited bridge processing logic to submit a fraudulent mint message.
However, Cysic maintained that the incident never compromised mainnet consensus, block production, or Ethereum Virtual Machine execution. The foundation also stated that attackers had not stolen existing user assets.
Founded in 2022, Cysic develops zero-knowledge proof infrastructure using dedicated hardware and its Layer 1 blockchain. Polychain Capital led its $6 million seed funding round in 2023.
Cysic said investigators must establish verified losses rather than calculate damages using the unauthorized token supply alone.
The foundation suspended cross-chain bridge transfers pending a security review and promised another report covering losses and fund tracing.
Similar incidents affected other networks. In September, Symbiosis suspended its Bitcoin bridge after an attacker minted synthetic assets and extracted approximately $336,000.
In June, a validation vulnerability allowed an attacker to mint approximately five billion unauthorized SYS tokens, prompting Syscoin to freeze its bridge.
