An attacker minted 10 million CYS through Cysic's cross-chain bridge on Saturday and moved 72 percent of it out within 28 minutes. The freeze on the receiving address came 48 minutes after the last token had already left.
Cysic has suspended its cross-chain bridge after an attacker minted 10 million CYS on BNB Smart Chain and sold most of the tokens within half an hour. The project blacklisted the receiving address at 13:47 UTC on Saturday, October 17, 76 minutes after the mint and 48 minutes after the last of the tokens had already moved, which left the freeze covering 2.8 million CYS, or 28 percent of what was created.
The mint went through at 12:31 UTC. Transfers out of the receiving address began five minutes later, and 7.2 million CYS left in 26 transfers spread across 15 transactions, finishing at 12:59. Cointelegraph and The Block each read the same chain records and give the mint and blacklist timestamps to the same minute.
The selling came in two rounds. Between 12:36 and 12:41, 5.65 million CYS went out in 11 transactions for 588,315 USDT, which works out at about 0.10 USDT a token on those trades. Between 12:57 and 12:59, a further 1.55 million CYS was sold for roughly 220 BNB. Twelve of the 15 transactions were routed through OKX's decentralized exchange aggregator, which split the orders across venues including PancakeSwap. That 0.10 figure is the price the attacker realized while selling into the available liquidity, not a quote for the token.
Moving the proceeds off BNB Chain started before the selling finished. At 12:44 the address sent 100,000 USDT into a BridgersSwap contract operated by SWFT, and about 40.88 ETH arrived on Ethereum a minute later. The remaining 488,315 USDT went to Mayan in six transfers between 12:46 and 12:53. Then 80 BNB went through Mayan at 13:05 and 139 BNB through deBridge a minute after that. On the Ethereum side, seven Mayan payouts totaling about 224.66 ETH and a 41.05 ETH deBridge payout landed by 13:06. The Block put the combined total at about 306.6 ETH, roughly $727,000 at about $2,372 per ETH on Sunday.
By 13:11 UTC, 306.52 ETH had moved on in five transfers to a second Ethereum address, which The Block reports first received funds about two hours before the mint and held about 309.5 ETH on Sunday morning. The earlier funding is a timing fact about that address, not evidence of who controls it or the address that received the minted tokens.
The blacklist Cysic applied runs on the CYS token contract on BNB Chain. It does not reach the ETH on Ethereum, so the 2.8 million frozen tokens are the only part of the mint the project can still restrict.
In an incident report posted on Sunday, the Cysic Foundation said its preliminary finding is that an attacker gained unauthorized access to a database used by services supporting the bridge. It said the incident was confined to the bridge's message-processing and minting functions and did not affect the Cysic mainnet, and that existing CYS and other assets in user wallets were not stolen or transferred. It also said the number of tokens minted does not by itself represent the final loss in dollar terms, with transfers, swaps and actual losses still under review. Those statements establish what Cysic says about cause and scope rather than an independent finding. The company has engaged a security firm it has not named to investigate and trace funds, and says it will publish a follow-up report on verified losses.
Ten million CYS is 1 percent of the one billion token total supply Cysic's own tokenomics documentation sets out. The documentation does not publish a circulating supply. That leaves the mint's size against the tradable float unestablished, and the float is what would determine the price effect of selling 7.2 million tokens into it. Cointelegraph reported no CYS price reaction.
Cysic was founded in 2022 and builds specialized hardware alongside a layer-1 network for generating zero-knowledge proofs. It raised a $6 million seed round in 2023 led by Polychain Capital. The suspended bridge moves tokens, CYS among them, between the Cysic chain, BNB Smart Chain and Base.
A first account of a bridge incident has recently proved incomplete. NEAR Intents said at the start of October that a bug in its Omni bridge had cost about $3.8 million, and the post-mortem it published two weeks later moved the fault to a failed deposit callback in a different contract. If Cysic's accounting holds and no user balances were touched, the cost of this one falls on CYS holders and on whoever supplied the liquidity that absorbed 7.2 million tokens, and recovery for that group is not something an issuer freeze addresses. Cysic has not said when the security review will finish or when the bridge will reopen.
