Cysic has suspended its cross-chain bridge after an attacker exploited the service to create 10 million unauthorised CYS tokens on BNB Chain.
The attacker sold 7.2 million of those tokens before Cysic blacklisted the receiving address, transferring about $727,000 in proceeds to Ethereum. The remaining 2.8 million CYS were frozen, according to on-chain records reviewed by The Block.
The Cysic Foundation said in an incident report posted to X on Sunday that the attacker “gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message.”
Cysic has suspended the bridge and appointed an unnamed security firm to investigate the incident and trace the funds.
The project, founded in 2022, develops specialised hardware and operates a Layer 1 network for generating zero-knowledge proofs. It raised a $6 million seed round led by Polychain Capital in 2023.
Its bridge allows assets, including CYS, to move between the Cysic chain and networks such as BNB Smart Chain and Base.
The foundation said the breach was limited to the bridge’s message-processing and minting functions and did not affect the Cysic mainnet. “Existing user assets were not stolen,” it said.
Cysic has not provided a dollar estimate for its losses, saying the number of tokens created “does not, by itself, represent the final loss in U.S. dollar terms.”
Tokens sold before blacklist
The fraudulent mint occurred at 8:31 a.m. ET on Saturday, according to on-chain data. Five minutes later, the receiving address began transferring CYS, sending 7.2 million tokens through 26 transfers across 15 transactions by 8:59 a.m. ET, BscScan records show.
The tokens were sold in two stages. Between 8:36 and 8:41 a.m. ET, the attacker sold 5.65 million CYS in 11 transactions for 588,315 USDT, equivalent to about 10 cents per token.
A further 1.55 million CYS was sold between 8:57 and 8:59 a.m. ET in four transactions, generating about 220 BNB. Twelve of the 15 transactions used OKX’s DEX aggregator, which distributed the orders across exchanges including PancakeSwap.
Cysic blacklisted the address in the CYS token contract at 9:47 a.m. ET. That action came 76 minutes after the exploit and 48 minutes after the wallet stopped transferring tokens, leaving its remaining 2.8 million CYS unable to move.
Funds transferred to Ethereum
The attacker sent 100,000 USDT to a BridgersSwap contract operated by cross-chain service SWFT at 8:44 a.m. ET. About one minute later, the address received 40.88 ETH on Ethereum.
The remaining 488,315 USDT was sent to cross-chain protocol Mayan in six transfers between 8:46 and 8:53 a.m. ET. After selling the BNB, the wallet transferred 80 BNB through Mayan at 9:05 a.m. ET and 139 BNB through deBridge one minute later.
Mayan paid out about 224.66 ETH in seven transfers, while deBridge sent 41.05 ETH. Including the SWFT transaction, the wallet received about 306.6 ETH, worth roughly $727,000 at Sunday’s ETH price of about $2,372, Etherscan records show.
By 9:11 a.m. ET, 306.52 ETH had been moved in five transfers to a second wallet. Cysic’s blacklist affects only CYS on BNB Chain and does not restrict the ETH.
The bridge will remain closed until the security review is complete. Cysic said it would publish a further report detailing verified losses and efforts to trace the funds.
