Cysic Halts BNB Bridge After 10M CYS Unauthorized Mint

Cysic suspended its cross-chain bridge on BNB Smart Chain after an attacker exploited a processing flaw to mint 10 million CYS on Saturday. Preliminary findings indicate that the attacker gained unauthorized access to a database supporting the bridge.

The mint occurred at 12:31:38 UTC, according to Cysic’s Sunday incident report on X. The company placed the recipient address on the CYS token contract’s blacklist at 13:47:52 UTC, restricting transfers from it. About 2.8 million CYS remained at the address when the report was published.

Cysic described the incident as limited to bridge message processing and token minting. Its mainnet and other operational systems were not affected. Existing CYS and other assets held in user wallets were not stolen or transferred without authorization, according to the company.

“The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets,” Cysic said.

The 10 million CYS figure does not establish the incident’s final dollar impact, according to the company. Investigators are reviewing transfers, swaps and any actual losses linked to the minted tokens.

Cysic has hired a security firm and plans to publish a follow-up report after the investigation is complete.

CYS is used to coordinate incentives for users, computing providers, governance participants and contributors in Cysic’s network, according to the project’s tokenomics documentation.