An attacker minted 10 million CYS on BNB Smart Chain through Cysic's cross-chain bridge at 12:31 UTC on Saturday, October 17. The attacker sold 7.2 million of them within half an hour and bridged 306.6 ETH, about $727,000, to Ethereum. Cysic froze the remaining 2.8 million tokens 76 minutes after the mint and suspended the bridge.
The Cysic Foundation published an incident report on X on October 18. Its preliminary finding is that the attacker gained unauthorized access to a database used by services supporting the bridge, then exploited a flaw in the bridge's processing logic to submit a fraudulent mint message. The foundation says the incident was confined to the bridge's message-processing and minting functions. In its words, "Existing user assets were not stolen."
How a forged message becomes real tokens
Cysic is a layer 1 network for zero-knowledge proof generation, with its own mainnet since December 2025 and a CYS token that also exists on BNB Smart Chain. A bridge like this one usually locks tokens on one side and mints a wrapped copy on the other. The mint only happens when an off-chain service tells the destination contract that a deposit occurred.
That service is the weak point. If the database it reads from can be written to by an outsider, a deposit that never happened looks like one that did. The contract then mints on command, because it trusts the message, not the chain. Cysic has not said how the database was reached, and its full root-cause analysis is still open.
The token contract carried one safeguard that limited the damage: a blacklist function. Once Cysic blacklisted the attacker's receiving address, the 2.8 million unsold tokens could no longer move. That is a centralized control, and it is also the reason 28 percent of the minted supply never reached the market.
Forged mint message accepted on BNB Smart Chain.
5.65M for 588,315 USDT, then 1.55M for about 220 BNB.
USDT and BNB sent through SWFT, Mayan and deBridge.
Proceeds forwarded to a second Ethereum wallet.
2.8M CYS frozen, 76 minutes after the mint.
Where the money went
The Crypto Times traced the 15 sales. Between 12:36 and 12:41 UTC the attacker sold 5.65 million CYS for 588,315 USDT, about 10 cents a token. Between 12:57 and 12:59 another 1.55 million went for about 220 BNB. Twelve of the fifteen sales ran through OKX's DEX aggregator, with fills on PancakeSwap and other pools.
The proceeds left BNB Smart Chain in pieces. At 12:44 the attacker pushed 100,000 USDT through SWFT's Bridgers. Six transfers totaling 488,315 USDT went to Mayan between 12:46 and 12:53. At 13:05 80 BNB followed through Mayan, and at 13:06 139 BNB went through deBridge. By 13:11 the attacker had consolidated 306.52 ETH in a second Ethereum wallet.
The dollar figure depends on when you price it. The Block and The Crypto Times both put the haul at about $727,000, using an ETH price near $2,370. The three bridge totals add up to 306.59 ETH, which matches the 306.6 ETH in both reports.
| Item | Amount | Share of mint |
|---|---|---|
| Minted without authorization | 10,000,000 CYS | 100 percent. |
| Sold on BNB Smart Chain | 7,200,000 CYS | 72 percent. |
| Frozen by blacklist | 2,800,000 CYS | 28 percent. |
| Circulating supply before the mint | 160,800,000 CYS | The mint equals 6.2 percent of it. |
Ten million tokens is 1 percent of the 1 billion maximum supply but 6.2 percent of the 160.8 million in circulation, The Crypto Times noted. That ratio is why a sub-million-dollar exploit moved the price. CoinGecko records a CYS low of $0.106 on October 17, the day of the attack, and a price of $0.114 on October 19, down 22.9 percent over seven days. The token's record high was $1.78 on August 15, five days after its Upbit listing.
What is still open
The foundation has engaged a security firm, which it did not name, to trace the funds and review the bridge. It says it has not verified the complete transaction trail or the final losses, and it promises a follow-up report covering verified losses, tracing and remediation. No reopening date for the bridge has been given, and no compensation plan has been announced.
The Korean venues kept trading. Bithumb's KRW-CYS market printed trades on October 19 at 151 won, and Upbit's BTC-CYS pair also traded that day, both on the exchanges' public tickers. Neither exchange's data showed a suspension of the pairs, though deposit and withdrawal status is a separate question we could not confirm. Our Cysic listing page now carries the incident and the new low.
Three things to watch: the follow-up report and whether the 2.8 million frozen tokens are burned, any exchange notice on CYS deposits over BNB Smart Chain, and the root cause of the database access. The last one matters beyond Cysic, because a bridge is only as safe as the service that signs its messages. Our wallet security guide explains why bridged assets deserve a separate risk budget.
