On Saturday, 17 October 2026, an attacker minted 10 million CYS tokens on BNB Smart Chain through the cross-chain bridge operated by the Cysic Foundation. Cysic builds specialized hardware and runs a Layer 1 network for generating zero-knowledge proofs. It suspended the bridge and published a preliminary incident report on 18 October. Here we set out what is established, what is not, and why the incident matters beyond one token.
According to the foundation's report, as relayed by The Block, Cointelegraph and crypto.news, the attacker "gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message." The mint was recorded at 12:31:38 UTC. At 13:47:52 UTC, Cysic added the receiving address to the CYS token contract's blacklist, which restricted transfers of the roughly 2.8 million CYS still held there.
Cysic says the incident was confined to bridge message processing and minting, and that the Cysic mainnet and other operational systems were not affected. "Existing user assets were not stolen," the foundation said. It has engaged a security firm, which it has not named, to investigate and trace the funds. The bridge stays closed until that review is complete.
On-chain records reviewed by The Block fill part of the gap between the mint and the freeze. The receiving address began moving tokens five minutes after the mint and sold 7.2 million CYS in two rounds: about 5.65 million tokens for a combined 588,315 USDT, then the remaining 1.55 million for about 220 BNB. Most of these trades were routed through OKX's DEX aggregator.
The proceeds were bridged to Ethereum through SWFT's Bridgers, Mayan and deBridge, arriving as about 306.6 ETH. The Block valued this at roughly $727,000 at Sunday's ether price of about $2,372. The ether then moved to a second wallet that, according to the same records, had first received funds about two hours before the mint. The blacklist applies only to CYS on BNB Chain, so it does not reach that ether.
Several points remain open. Cysic has not said how the database was accessed or identified the exact flaw in the processing logic. It has not published a verified loss figure, and stresses that the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms." It is not known whether any recovery is possible. No independent forensic report has been released, and no reopening date for the bridge has been announced. Cysic says it will publish a follow-up report on verified losses and on its tracing efforts.
The core lesson is architectural. A bridge mint is only as trustworthy as the component that decides a mint is legitimate. By Cysic's own account, an off-chain database used by services supporting the bridge became a path to authorizing new supply on another chain. Well-reviewed contracts offer limited protection if a supporting service can feed them a message they will accept. In practice, the trust boundary of a bridge includes every database, queue and relayer upstream of the minting contract.
The incident is not isolated. Crypto.news places it alongside other unauthorized-mint cases this year. In the SAND bridge exploit in August, it reports, about 329 trillion unbacked tokens were created, while the confirmed reserve drain was roughly $675,000. In a THEO incident reported on 13 October, security firm PeckShield said an attacker created 19 million tokens and exchanged them for about 700.8 ETH. A mint count measures nominal supply, not value extracted.
The response also shows a familiar trade-off. By our calculation from the reported figures, the blacklist held back 2.8 million of the 10 million minted tokens, or 28%. It took effect 76 minutes after the mint and, according to The Block, 48 minutes after the address had stopped sending out tokens. By then most of the minted tokens had been sold and the proceeds were already on Ethereum. Freeze powers can limit damage, but they act after the fact and raise their own questions about centralized control. On this timeline, the decisive window was the first half hour, which points to automated detection on the minting path rather than a manual freeze.
For teams that operate or integrate bridges, the practical questions are concrete:
We will follow Cysic's follow-up report and update this analysis once the access method and the verified losses are disclosed.
This article is for information only and is not investment advice. Figures are taken from the sources above and may change as the investigation continues.
SecurityJul 31, 2026
On July 31, 2026, a flaw in Coldcard's random number generator made thousands of seed phrases predictable. What happened, how the attack works technically, and which architectural choices in XColdPro make this class of vulnerability structurally different.
XColdProMay 10, 20264 min
April 2026 reminded DeFi of a hard truth: the weakest point is no longer always the smart contract. From Drift to KelpDAO to Purrlend, attackers moved through people, permissions, bridges, and off-chain infrastructure. This is exactly why cold storage must move beyond hardware wallets and hot-wallet convenience.
