The Cysic Foundation reported that an attacker exploited a processing flaw to mint 10 million CYS tokens on BNB Smart Chain on October 17. The bridge was halted, the receiving address blacklisted within 76 minutes, and a security firm engaged to trace the funds.
The Cysic Foundation disclosed that on October 17, 2026 an attacker leveraged a vulnerability in the bridge’s message‑processing logic to mint 10 million CYS tokens on BNB Smart Chain at 12:31:38 UTC (source 1). Within 76 minutes the protocol added the recipient address to the token contract’s blacklist at 13:47:52 UTC, halting further transfers (source 2). The bridge was immediately suspended and remains offline indefinitely while a full security review is conducted.
Scope of the breach and immediate impact
At the time of the blacklist, approximately 2.8 million CYS remained frozen in the compromised address, meaning roughly 7.2 million tokens—about 72 % of the unauthorized mint—had already moved to other wallets (source 2). Cysic emphasized that the incident was confined to the bridge’s minting and message‑processing components; the mainnet, consensus layer, and existing user assets were not affected (source 4). The 10 million newly created tokens represent 1 % of CYS’s 1 billion‑token maximum supply and a notable addition to the circulating supply of about 160.8 million tokens (source 3).
Cysic has hired an external security firm to investigate the breach, trace the displaced tokens, and assess any realized losses (source 1). A follow‑up report will be published after the investigation phase, detailing the final impact, fund‑tracing progress, and remediation steps (source 2). Until the bridge is cleared for operation, users cannot move CYS across chains via the service.
The exploit underscores the persistent risk posed by cross‑chain bridges, echoing similar incidents such as the Fetch.ai SingularityNET breach in September and the Syscoin bridge attack earlier this year (source 2). Industry observers note that weaknesses often stem from off‑chain components feeding bridge logic, suggesting that future security audits must extend beyond smart‑contract code to the supporting infrastructure (source 3).