Key Takeaways:
- An attacker managed to create 10 million CYS using the Cysic cross-chain bridge on BNB Smart Chain.
- Cysic blacklisted the recipient address, thereby freezing approximately 2.8 million CYS still in the add.
- No assets on the mainnet were affected by the incident nor were any existing assets impacted.
The cross-chain bridge was suspended by the Cryptic Foundation due to an exploit in the Cross Chain Bridging message processing and minting flow that allowed an attacker to create 10 million CYS without authorization.
https://t.co/bK2X8Ca2sk
— Cysic Foundation (@cysic_fdn) October 18, 2026
The team indicated that such a breach was limited to the bridge infrastructure and not to the consensus mechanism (Cysic mainnet), execution of transactions, or existing tokens in user wallets.
Cysic Bridge Mints 10 Million CYS Without Authorization
The mint was unauthorized at 12:31:38 UTC 2026/10/17 on BNB Smart Chain.An unauthorized mint happened at 17:31:38 UTC 2026/10/17 on BNB Smart Chain.
In the preliminary investigation, Syschick decided the attacker had successfully breached access to a database that service supporting the bridge was using, and then exploited a vulnerability in the related processing logic to send a fraudulent mint message.
That message resulted in the creation of 10 million CYS at a single recipient address. Cysic urged against considering the count of the token as the bottom line. Actual dollar affect and transfers and swaps are still under investigation.
Read More: Liquid Network Pauses After 4,000 BTC Worth $320M Pulled in White-Hat Incident
2.8 Million CYS Remain Restricted
Cysic began adding the receiver address to the CYS token contract blacklist at 13:47:52 UTC, about 76 minutes after the illicit money printing.
The restriction was activated onchain, and is currently hindering transfers for approximately 2.8 million CYS still held at the address. The team is still tracking down the next $3,380.41, using help from a professional security firm.
Mainnet and Existing User Assets Were Not Hit
The dispute was not to challenge the bridge’s message-processing and minting capabilities, Cysic said.
Its mainnet hasn’t been affected by the infrastructure as yet, and all consensus, block-production and transaction-confirmation and EVM-execution features remain unaffected.
There was also no evidence of any existing CYS or other assets being stolen from user wallets, the foundation added. That is significant because the exploit was not a depleter but did, instead, create new tokens that users were not holding.
Read More: CoinEx Announces Permanent Shutdown After 9 Years, Withdrawals End Dec. 22
Cross-Chain Bridge Stays Closed During Review
Cysic immediately suspended the operation of the bridges after the incident was detected and stated the service will not be reinstated until the whole work flow is reviewed. The investigation now extends to the handling of the messages, the permissions settings, the asset records and the entire attack path.
Cysic has yet to announce a reopening date. The bridge will not reopen until the security assessment is finished and the remediation recommended will be verified.
When in the investigation phase there will be a follow-up report to include the benefits of the investigation and with actual losses derived; progress of fund-tracing and the final remediation steps will be included.
