Cysic bridge exploit: 10M CYS minted via fake message

Not stated by Cysic: 'The number of tokens minted does not, by itself, represent the final loss in U.S. dollar terms.' Cysic: 10,000,000 CYS minted; transfers of the approximately 2.8 million CYS remaining at the recipient address are restricted. The Block's on-chain review: ~306.6 ETH (~$727,000) received on Ethereum.

Root cause: Per Cysic (preliminary): 'the attacker gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message.' Cysic adds: 'The full attack path and root cause remain under investigation.'

Timeline, as sourced: 17 Oct 2026, unauthorized mint at 12:31:38 UTC; blacklist effective 13:47:52 UTC (both per Cysic incident report, posted on X 18 Oct 2026 10:10 UTC).

On 17 October 2026 at 12:31:38 UTC, an attacker minted 10,000,000 CYS on BNB Smart Chain through the Cysic cross-chain bridge. In its incident report (opens in a new tab), the Cysic Foundation says preliminary findings indicate the attacker gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message; the full attack path and root cause remain under investigation. Cysic suspended the bridge, blacklisted the recipient address at 13:47:52 UTC, restricting the approximately 2.8 million CYS remaining there, and says existing user assets were not stolen and its mainnet was unaffected. It has not stated a dollar loss. The Block's on-chain review (opens in a new tab) found about 306.6 ETH reached Ethereum.