Cysic Halts Bridge After 10 Million CYS Minted on BNB Smart Chain

Blacklist Freezes 2.8 Million CYS 76 Minutes After Mint

Cysic has suspended its cross-chain bridge after an attacker minted 10 million CYS tokens without authorization on BNB Smart Chain on October 17. In a statement posted on X on October 18, the Cysic Foundation said its preliminary investigation identified unauthorized access to a database behind the bridge, which the attacker then used to submit fraudulent minting messages. The project's incident timeline places the unauthorized mint at 12:31:38 UTC. The mechanism, as the Foundation describes it, sits in the bridge's message-processing layer: a bridge of this type verifies transfer instructions on one network before authorizing corresponding activity on another, and the attacker allegedly manipulated that process to authorize the creation of new CYS. Cysic describes its platform as a decentralized computing network that coordinates computing resources and rewards participants, with CYS supporting governance, access to computing resources and payments to hardware providers. The exploit played out on BNB Smart Chain, whose recent growth includes 1.72 million tokenized stock holders added in 90 days. Containment was quick by bridge-incident standards. At 13:47:52 UTC on October 17, 1 hour, 16 minutes and 14 seconds after the recorded mint, the team added the recipient address to the token contract's blacklist, blocking transfers of the roughly 2.8 million CYS still sitting there. The Foundation said mainnet operations and other systems were unaffected and no assets were removed from existing customer wallets, including holdings on the network many users reach by connecting MetaMask to BNB Smart Chain. The suspension is meant to stop further activity through the affected service while investigators trace token movements; no reopening date has been set. How the database was accessed, which weakness was exploited and which transactions triggered the mint remain undisclosed, and no independent forensic report accompanied the announcement.

Mint Equals 1% of the 1 Billion Supply

The frozen wallet accounted for 28% of the unauthorized issuance, using the announced 10 million-token figure as the reference point. The remaining 7.2 million tokens were not at the blacklisted address, and that absence does not establish how many were sold, moved elsewhere, recovered or converted into other cryptocurrencies. Cysic has not reported a completed recovery of any tokens outside the frozen wallet, and investigators are tracing transfers and reviewing possible swaps to establish the actual financial consequences. The project has stopped short of any dollar figure: its incident report distinguishes the number of tokens created from the value the attacker may have obtained through completed transactions, and a market-price calculation would only estimate the notional value of new supply, not the amount anyone could realistically sell into the concentrated liquidity of CYS trading markets. No verified total for attacker proceeds, no complete recipient list and no independent valuation of assets that left the system has been published. Scale is easier to judge against the token's own design. Cysic's published tokenomics put total supply at 1 billion CYS, so the unauthorized mint equals 1% of that figure. Allocations run 40.19% to ecosystem incentives, 23.62% to investors, 12.11% to contributors, 8% to the foundation treasury and 16.08% to community incentives and liquidity. Holders can stake CYS to receive CGT, the project's nontransferable governance token, which covers protocol proposals, validator selection and economic parameter decisions, while compute providers use CYS to reserve capacity for zero-knowledge proof generation and AI workloads. Unauthorized minting through bridge flaws has recurred across 2026: The Sandbox's SAND incident produced 329 trillion unbacked tokens against a confirmed drain of about $675,000, and PeckShield reported 19 million THEO minted in the Autheo exploit on October 13, swapped for roughly 700.8 ETH. Cysic's investigation has yet to produce a comparable figure.

The 7.2 Million Tokens Still Unaccounted For

The on-chain record here is unusually clean: the mint at 12:31:38 UTC and the blacklist transaction roughly 76 minutes later are both directly verifiable on BNB Smart Chain, so the containment figure does not rest on the team's word alone. The root cause, per the Foundation's preliminary post-mortem, sits in database access controls and the message-processing logic of the bridge protocol. What the response has changed is scope: 28% of the mint is frozen, the bridge is offline and the mainnet reportedly held. What it has not settled is the other 7.2 million tokens, which have no verified accounting, no completed recovery and no quantified proceeds. Tracing flows on BNB Chain is already a live exercise, as when CZ called on the community to trace a $92.9 million Ledger reseller drain. The follow-up report the Foundation intends to publish remains, at this stage, an intention rather than a finding.