Cysic halts cross-chain bridge after unauthorized mint of 10 million CYS on BNB Chain
In brief
- Cysic says an attacker exploited a bridge processing flaw to mint 10 million CYS on BNB Smart Chain.
- The mint occurred at 12:31:38 UTC; the recipient address was blacklisted at 13:47:52 UTC.
- About 2.8 million CYS remained at the address, with transfers restricted.
- Cysic says its mainnet and user wallets weren't affected; losses remain under review.
- Cysic has hired a security firm and plans a follow-up report.
A mint, then a blacklist
The unauthorized mint occurred at 12:31:38 UTC, according to Cysic's X incident report as reported by Cointelegraph. Cysic added the recipient address to the CYS token contract's blacklist at 13:47:52 UTC.
That's when the address was frozen.
About 2.8 million CYS remained at that address, with transfers restricted, per the report. The company said it's still investigating the unauthorized issuance on BNB Smart Chain. Its explanation for the breach (unauthorized access to a database supporting the bridge) is a preliminary finding, not a confirmed cause.
What Cysic says wasn't touched
Cysic said the incident was limited to bridge message processing and minting and didn't affect the mainnet or other operational systems. The company also spoke to user funds directly.
“The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets,” it said.
Both of those assurances come from Cysic itself. According to Cysic's tokenomics documentation, CYS coordinates incentives for users, compute providers, governance participants and contributors in its network, so the token plays a central role in how the project runs.
No dollar figure yet
So how much did the exploit cost? Cysic hasn't said. The company said the mint size alone doesn't establish the incident's dollar impact, and token transfers, swaps and actual losses are still under review. The 10 million figure is a count of tokens minted (it isn't a loss estimate).
Cysic has hired a security firm and plans to publish a follow-up report after the current investigation phase, which is where we'd expect any final loss accounting to show up.
Frequently asked questions
Were Cysic user wallets affected by the CYS bridge exploit?
Cysic said the incident did not result in theft or unauthorized transfer of existing CYS or other assets held in user wallets. The company also said the incident was limited to bridge message processing and minting and did not affect its mainnet or other operational systems. Both statements come from Cysic.
How much money was lost in the Cysic bridge exploit?
Cysic hasn't given a dollar figure. The company said the size of the 10 million CYS mint alone does not establish the incident's dollar impact, and token transfers, swaps and actual losses remain under review. It has hired a security firm and plans a follow-up report.
What caused the unauthorized CYS mint?
Cysic said an attacker exploited a processing flaw in its cross-chain bridge to mint 10 million CYS on BNB Smart Chain. The company's preliminary findings point to unauthorized access to a database supporting the bridge. That cause hasn't been confirmed yet.
