BTC $81,001 -0.51%ETH $2,358 -2.30%XRP $1.27 -2.06%SOL $102 -2.06%DOGE $0.07728 -3.11%USDT — —USDC — —BTC $81,001 -0.51%ETH $2,358 -2.30%XRP $1.27 -2.06%SOL $102 -2.06%DOGE $0.07728 -3.11%USDT — —USDC — —

Cysic Suspends Bridge After 10 Million CYS Tokens Minted

Cysic suspended its cross-chain bridge after an attacker minted 10 million CYS tokens on BNB Smart Chain, prompting urgent security measures.

Cysic has suspended its cross-chain bridge after an attacker minted 10 million unauthorized CYS tokens on BNB Smart Chain on October 17, 2026. The attacker is said to have sold 7.2 million tokens and moved around 306.6 ETH (valued at $727 000) to Ethereum before the remaining 2.8 million CYS were frozen. The incident had no impact on the mainnet or assets of existing users of Cysic.

Cysic Investigates Unauthorized CYS Token Minting

The attacker took advantage of vulnerabilities in the bridge’s message-processing system, according to the incident report on X posted by the Cysic Foundation. Initial results show unauthorized access to a database that supports the bridge’s operation. But investigators have not verified the full attack technique.

On Oct 17, a security incident involving the unauthorized minting of 10M CYS occurred through the Cysic bridge.
Our team responded swiftly. User wallets and mainnet operations remain unaffected.
The bridge remains suspended pending security review.
Full update below. 👇 https://t.co/t0CT9LNXGJ
— Cysic (@cysic_xyz) October 18, 2026

The attack was carried out on October 17 at 12:31:38 UTC. As a result, there were 10 million extra CYS tokens on BNB Smart Chain that were not authorized. The foundation stated that the incident was an isolated bridge security failure.

In addition, the incident had no impact on the mainnet operations of Cysic, it said. The affected bridge system did not affect block production, transaction confirmation or EVM transaction execution. There was also no theft or unauthorized transfers of existing assets in user wallets, the foundation reported.

The unauthorised token creation, however, enabled the attacker to sell newly minted CYS. The attacker reportedly sold around 7.2 million tokens in 23 minutes. The incident thus brought to light concerns regarding the security of the bridge and the issuance of unauthorized tokens.

The attacker also sent around $727,000 in ETH (~306.6 ETH) to Ethereum. The attacker reportedly used SWFT’s Bridgers, deBridge and Mayan to move money. However, investigators have to build up the entire transaction history and ascertain if there is any further recovery.

Cysic Freezes Remaining Tokens and Keeps Bridge Suspended

Cysic responded by suspending its cross-chain bridge and limiting the attacker’s wallet address. The foundation also hired a professional security company to investigate the incident and to trace the money. The bridge is closed in the meantime as the team is looking at its security systems.

At 13:47:52 UTC, Cysic blacklisted the recipient wallet address, according to reported incident timelines. The remaining 2.8 million CYS tokens were reportedly “frozen”. Consequently, no more transfers of those tokens could be made from the restricted address.

The attacker had already sold millions of tokens, but the response was able to contain the incident. Moreover, the foundation has not established the final financial impact from the unauthorized minting. The number of tokens produced does not necessarily reflect their dollar value or losses.

It is important to note that newly minted tokens are not the same as tokens stolen from existing wallets. The incident did not affect user wallets or its mainnet, said Cysic. But users must wait for official updates before doing any cross-chain transactions.

The foundation has not yet said when it will resume providing bridge services. So, the suspension will remain in place as a precaution until investigators determine the vulnerability and supporting database access. The next updates from Cysic should be able to explain why the services are down, what is being done to fix the services and what conditions need to be met to restore the services.

For now, the incident highlights the security risks associated with cross-chain bridges and their message-processing systems. Cysic has limited the affected address, but the investigation continues.