Cysic Bridge Exploit Mints 10M CYS, $727K in Ether Moved

Cysic has suspended its cross-chain bridge after an attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain and moved about $727,000 in ether to Ethereum, according to Coincentral. The Cysic Foundation disclosed the incident in a report posted on X on October 18, 2026.

The mint took place at 8:31 a.m. ET on October 17. Coincentral reported that the attacker exploited a flaw in the bridge’s processing logic to submit a fake mint message, and that early findings point to unauthorized access to a database supporting the bridge. Blockonomi put the mint time at 12:31:38 UTC, which matches the ET figure, and described the breach as faulty authentication of bridge messages rather than a failure of network consensus.

Key facts

• The attacker minted 10 million CYS, equal to 1% of the project’s 1 billion total supply, according to Blockonomi.
• The receiving address sold 7.2 million CYS between 8:36 and 8:59 a.m. ET, including 5.65 million tokens for 588,315 USDT and the remaining 1.55 million for about 220 BNB.
• The attacker moved about 306.6 ETH, worth roughly $727,000 at Sunday’s price of about $2,372, to Ethereum through SWFT, Mayan and deBridge.
• Cysic blacklisted the address at 9:47 a.m. ET, 76 minutes after the mint, freezing about 2.8 million CYS.
• Cysic says the mainnet and existing user assets were unaffected.

How the sale and the cross-chain transfer unfolded

On-chain records cited by Coincentral show the receiving address began moving tokens five minutes after the mint, sending out 7.2 million CYS in 26 transfers by 8:59 a.m. ET. Twelve of the 15 sale transactions went through OKX’s DEX aggregator. At 8:44 a.m. ET, the address sent 100,000 USDT to a SWFT contract and received 40.88 ETH on Ethereum about a minute later, then routed the other 488,315 USDT to Mayan. It later bridged 80 BNB through Mayan and 139 BNB through deBridge, bringing total Ethereum receipts to about 306.6 ETH. By 9:11 a.m. ET, 306.52 ETH had moved to a second wallet, which held about 309.5 ETH on Sunday morning.

Cysic’s blacklist covers only CYS on BNB Chain, so it does not apply to the ether. Because the tokens were sold across decentralized venues and the proceeds spread across several bridges, Blockonomi noted that recovery becomes harder as funds are split among destinations. Bitcoinist reported that the intervention came after a substantial portion of the unauthorized issuance had already been traded, and that new tokens entering the market can pressure the CYS price and expose liquidity providers to losses.

Differing figures and unverified losses

The reports agree on the core amounts but part on their handling of the loss figure. Coincentral and Blockonomi both cite 306.6 ETH and roughly $727,000, but Blockonomi noted that the foundation has not verified the complete transaction trail or final losses and cautioned that the amount transferred to Ethereum should not be treated as the confirmed financial loss. Cysic itself said the number of tokens minted does not by itself indicate the final loss in dollars. For the 2.8 million frozen CYS, Blockonomi described the figure as a verified containment measure rather than evidence of recovery, representing 28% of the mint. Cysic said it hired an unnamed security firm to investigate and trace the funds.

Why it matters

Cross-chain bridges verify that tokens issued on one network correspond to an authorized event elsewhere. When that check fails, an attacker can create unbacked assets and sell them into available liquidity before a project can respond. The incident is one of several bridge failures that have made message validation a persistent weak point in token infrastructure. Cysic was founded in 2022 and raised a $6 million seed round led by Polychain Capital in 2023, with about 160.8 million CYS in circulation, according to CoinMarketCap. Blockonomi reported that users have been warned against fake compensation links, recovery pitches and requests for private keys.

What to watch

Cysic said the bridge will stay closed until a security review is complete, and Blockonomi reported it has no reopening date. The foundation plans a follow-up report covering verified losses and its efforts to trace the funds. An on-chain update on the destination wallets would show whether any of the ether is recovered.

This article is for informational purposes only and is not financial advice. Crypto markets are volatile and uncertain; readers should do their own research before making any investment decision.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, Bitcoinist, Blockonomi