Cysic has suspended its cross-chain bridge after an attacker exploited weaknesses in its message-processing logic to mint 10 million CYS tokens without authorization on BNB Smart Chain. The Cysic Foundation confirmed the unauthorized mint occurred at 12:31:38 UTC on October 17, according to an incident report published on October 18.
Preliminary findings indicate the attacker gained unauthorized access to a database supporting bridge services and then submitted a fraudulent mint message. The bridge was shut down to prevent further activity. At 13:47:52 UTC, about 76 minutes after the mint, the team added the recipient address to the CYS token contract’s blacklist, freezing roughly 2.8 million CYS. By that time, approximately 7.2 million CYS—72% of the unauthorized issuance—had already moved to other addresses.
Ten million newly minted tokens represent 1% of CYS's 1 billion maximum supply. Cysic emphasized that the number of tokens minted does not by itself establish the final dollar loss, and investigators are tracing transfers, swaps and realized losses. An external security firm has been engaged, and a follow-up report is planned.
The foundation said the incident was confined to bridge message-processing and minting functions. The mainnet, including consensus, block production and EVM execution, remained unaffected, and existing user assets were not stolen. The bridge will remain closed indefinitely and will reopen only after a full security review.
CYS powers computing and governance within the Cysic decentralized computing network, including incentives for zero-knowledge proof generation and AI workloads. The incident follows other cross-chain bridge exploits in 2026, including unauthorized SAND and THEO mints, underscoring bridge vulnerabilities as a persistent attack surface.
