Cysic, a blockchain project building zero-knowledge proof hardware and a layer-1 network, has suspended its cross-chain bridge after an attacker minted 10 million CYS tokens without authorization on BNB Chain and converted part of the proceeds into roughly $727,000 worth of ether.
The Cysic Foundation said in an incident report that the breach occurred on Oct. 17 and stemmed from unauthorized access to a database supporting bridge operations. The attacker exploited a weakness in the message-processing flow to submit fraudulent token-issuance requests, bypassing normal approval checks and creating a large supply of CYS outside the intended minting process.
On-chain records show the attacker sold 7.2 million of the newly created tokens in a series of transactions. 5.65 million CYS were swapped across 11 trades for roughly 588,315 USDT, while the remaining 1.55 million tokens were sold for 220 BNB. Some of those orders were routed through PancakeSwap via OKX's decentralized exchange aggregator.
The proceeds were then moved across chains using SWFT, Mayan and deBridge, yielding 306.6 ETH, or approximately $727,000 at prevailing prices. Most of that ether has since been sent to separate wallets.
Cysic blacklisted the attacker's address 76 minutes after the first transaction, freezing 2.8 million CYS that had not yet been sold. The measure applied only to the token on BNB Chain, however, and does not affect funds already transferred to Ethereum.
The foundation said the incident was confined to the bridge's message-processing and token-issuance functions and did not touch the Cysic mainnet. "Existing user assets were not stolen," it said in the report.
The final dollar loss has not been determined. Cysic said the number of tokens minted without authorization does not by itself represent the ultimate financial damage, and it has hired an outside security firm to investigate the breach and trace the funds. Bridge operations will stay offline until a security review is complete.
The project has not published a remediation timeline or described the specific contract vulnerability in public. The attacker's identity remains unknown, and it is unclear whether the unsold tokens will be burned, written off through a snapshot rollback or handled some other way -- a decision that will shape confidence in the token's supply integrity.
Note: Figures are from the Cysic Foundation's incident report and on-chain records cited in it.
The episode highlights a persistent risk in cross-chain infrastructure, where a single flaw in message verification can let an attacker inflate a token's circulating supply faster than a team can react. Bridge exploits on BNB Chain have historically unfolded within minutes, leaving projects little time to block transactions before assets move to another network.
For Cysic, the immediate test is operational: restoring the bridge only after an audit, publishing a clear account of how the 10 million tokens will be removed from supply, and showing that no other bridge pairs were affected. Until then, the token's reported circulating supply and its pricing on trackers and exchanges may be viewed with caution by market participants.
Cysic was founded in 2022 and raised $6 million in a seed round led by Polychain Capital in 2023. The project's focus on zero-knowledge proof generation has made its token and bridge infrastructure a reference point for investors watching security standards across decentralized finance.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
