Cysic Halts Bridge After Unauthorized Minting of 10 Million CYS
Cysic halted its cross-chain bridge after an incident on BNB Smart Chain. A total of 10 million CYS tokens were created without authorization, while the final extent of the damage remains unknown.
Cysic halted its bridge after 10 million CYS tokens were unauthorizedly minted on BNB Smart Chain. In its incident report, the project said the issue involved message processing in the bridge and the minting function. According to Cysic, the mainnet and other operational systems were not affected.
The incident occurred on October 17, 2026, at 12:31:38 UTC, based on the minting timestamp cited in reporting on the case. Cysic subsequently halted operation of the cross-chain bridge, a component designed to transfer tokens between blockchains.
Cysic halted the bridge and restricted the address linked to the incident
The project said it deployed an on-chain blacklist for the address associated with the incident. According to the project, approximately 2.8 million CYS remained at the address, and their transfer was restricted in this way. However, it has not been confirmed how many of the unauthorized tokens were moved before this step, or whether any tokens were liquidated.
The BEP-20 contract for the CYS token on BNB Smart Chain is also publicly verifiable. The existence of the contract alone, however, does not establish the final scope of the incident or the financial damage without additional forensic data.
The preliminary explanation has not yet been independently confirmed
According to Cysic’s preliminary statement, the attacker allegedly gained unauthorized access to the database serving the bridge and subsequently exploited a flaw in message-processing logic. This explanation has not yet been independently confirmed through forensic analysis.
Unauthorized minting means that 10 million CYS were created without proper backing in the bridge’s mechanism. Such an event could undermine confidence in bridged versions of the token and affect its supply. According to Cysic, the incident did not affect the mainnet; the theft of existing user assets has not yet been confirmed.
What is not yet known
- The final financial damage and the number of tokens that may have been moved or liquidated before the block.
- Independent confirmation of the attack’s technical vector.
- When Cysic will restart the cross-chain bridge.
- The security measures the project will disclose before resuming operations.
Further information should come from the project’s forensic report, on-chain token movements, and any potential action against the addresses to which the unauthorized CYS were sent.
Sources
- Cointelegraph – Reports Cysic’s incident statement, the scale of the unauthorized minting, the bridge suspension, and the restriction of approximately 2.8 million CYS.
- TechFlow – Corroborates that the Cysic Foundation published a report on October 18 concerning the October 17 incident, including the preliminary cause and the claim that the mainnet was unaffected.
- BscScan – Provides a public record of the CYS token contract on BNB Smart Chain.
Verified and updated: October 18, 2026, 15:21
