Hlib Chabaniuk

Cysic halts crypto bridge after unauthorized mint on BNB Smart Chain

Cysic halts crypto bridge after unauthorized mint on BNB Smart Chain
Cysic bridge breach

A security incident at Cysic disrupts cross-chain token operations after 10 million CYS are minted without authorization on BNB Smart Chain. The company says the breach is confined to bridge message processing and that the token amount created does not by itself determine the final financial impact.

Highlights

  • Cysic suspends its cross-chain bridge after an attacker mints 10 million CYS on BNB Smart Chain by exploiting a processing flaw on June 8.
  • About 2.8 million CYS remains at the attacker’s address with transfers restricted, as Cysic blacklisted the recipient within 76 minutes of the unauthorized mint.
  • Cysic states the incident is limited to bridge message processing and does not involve theft or unauthorized transfer of existing CYS or user-held assets; financial impact remains under assessment.

Bridge suspension and incident timeline

As reported by Cointelegraph, citing Cysic in a Sunday incident report on X, the company suspends its cross-chain bridge after an attacker exploits a processing flaw to mint 10 million CYS on BNB Smart Chain on Saturday. Preliminary findings point to unauthorized access to a database that supports the bridge infrastructure.

The mint takes place at 12:31:38 UTC, and Cysic says it adds the recipient address to the token contract blacklist at 13:47:52 UTC. About 2.8 million CYS remains at that address, with transfers restricted.

CYS is used to coordinate incentives for users, compute providers, governance participants and contributors across Cysic's network, according to the project's tokenomics documentation. The company says it is still reviewing token transfers, swaps and any actual losses tied to the incident.

Operational scope and market implications

Cysic says the incident is limited to bridge message processing and minting, and does not affect the mainnet or other operational systems. It also says the event does not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets.

The company says the number of tokens minted does not establish the final dollar loss, leaving the financial impact under assessment while the investigation continues. Cysic has hired a security firm and says it plans to publish a follow-up report after the current phase of the review.

In our earlier coverage of CTOS Digital’s cybersecurity incident, we detailed how the breach and resulting service disruption were expected to pressure earnings and revenue. The company projected a RM12 million drop in net profit and a RM16 million revenue decline for the year if some services stayed unavailable into the third week of October, noting that each additional week of disruption could further weigh on results.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.