Cryptoupdated 1h ago2 min read
Cysic Halts BNB Chain Bridge After Attacker Mints 10 Million CYS, Moves $727,000 Ether
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Attacker minted 10 million CYS on BNB Chain via bridge exploit. The attacker sold about 7.2 million CYS and moved roughly $727,000 in ETH.
Save coverage image
One story. Different accounts.
“The technical findings remain preliminary.”
“According to the Cysic Foundation's report, published on October 18, 2026”
Explore source coverage 3 source types
Directory totals describe our source library, not outlets checked for this story.
Bridge exploit mints tokens
Cysic halted its cross-chain bridge after an attacker minted 10 million CYS tokens without authorization on BNB Chain on Oct. 17, then sold 7.2 million of them and moved about $727,000 in ether to separate wallets.
The Cysic Foundation said the breach involved unauthorized access to a database supporting bridge operations and abuse of a weakness in message processing that bypassed approval checks.
Cysic blacklisted the attacker’s address roughly 76 minutes after the first transaction, freezing 2.8 million CYS, while the blacklist applied only on BNB Chain and did not reach funds already on Ethereum.
Onchain records show the attacker received 306.6 ETH on Ethereum before Cysic blacklisted the address, and the project said the incident was confined to the bridge’s message-processing and token-issuance functions.
Cysic said it suspended bridge operations pending an outside security review and that it had not published a remediation timeline or described the specific contract vulnerability in public.
Mint to blacklist timeline
On-chain data reviewed by CoinMarketCap matched Cysic’s account, with the recipient address receiving 10 million minted tokens and still holding about 2.8 million CYS when Cysic blacklisted the address on-chain roughly 76 minutes after the mint.
CoinMarketCap also said the minting occurred at 12:31 pm UTC on Oct. 17, according to an incident report Cysic published on X.
The attacker’s sales were described as two rounds, with 5.65 million CYS sold in 11 transactions for a combined 588,315 USDT and the remaining 1.55 million CYS sold in four transactions for about 220 BNB.
12 of the 15 transactions were routed through OKX’s DEX aggregator, which split the orders across exchanges including PancakeSwap.
Cysic blacklisted the address in the CYS token contract at 9:47 a.m. ET, freezing the remaining 2.8 million CYS, and the blacklist landed 76 minutes after the initial exploit transaction.
What is at stake next
Cysic said existing user assets were not stolen and that the incident did not affect the Cysic mainnet, while the project also said the final dollar loss had not been determined. Cysic has not disclosed a dollar figure for its losses, noting that the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms." Cysic blacklisted an address holding approximately 2.8 million CYS and restricted further transfers from that wallet, while investigators reviewed token movements and potential losses before Cysic releases its next security report publicly.
The bridge the attacker ran through has been switched off since, and the foundation has named no date for a restart. Cysic said it hired an outside security firm to investigate the breach and trace the funds, and it planned to publish a follow-up report once its security review is complete.