Cysic, the zero-knowledge proof infrastructure and decentralized compute network, has suspended its cross-chain bridge following a security incident on October 17, 2026.
An attacker exploited the system to create 10 million unauthorized CYS tokens on BNB Smart Chain, then liquidated the majority of them and moved the proceeds to Ethereum before the project could fully contain the activity.
According to the Cysic Foundation’s incident report, preliminary findings show the attacker obtained unauthorized access to a database used by services supporting the bridge.
The attacker then abused a flaw in the message-processing logic to submit a fraudulent mint request.
This produced 10 million CYS at 12:31:38 UTC. The tokens were delivered to the address 0xA4e1827Fe2664fD0797a55e442b2e2639449C255.
The foundation emphasized that the full attack path and root cause remain under investigation.
Cysic activated its response procedures quickly.
It suspended bridge operations, engaged an external security firm to investigate and trace funds, and added the recipient address to the on-chain blacklist in the CYS token contract at 13:47:52 UTC—roughly 76 minutes after the mint.
The blacklist froze the remaining approximately 2.8 million CYS still held at that address, preventing further transfers of those tokens on BNB Smart Chain.
The restriction does not extend to assets already moved to other networks.
On-chain records examined by reporters show the attacker moved swiftly after the mint. Within minutes the address began transferring tokens. Across 15 transactions, it sold 7.2 million of the newly created CYS.
Roughly 5.65 million tokens were exchanged for about 588,315 USDT, while the remaining 1.55 million were sold for approximately 220 BNB.
Many of the trades were routed through OKX’s decentralized exchange aggregator and executed on venues including PancakeSwap.
The attacker then bridged the proceeds off BNB Chain using three separate services: SWFT’s Bridgers, Mayan, and deBridge.
On Ethereum the same address received multiple payouts totaling about 306.6 ETH.
At prevailing prices near $2,370 per ETH, this amounted to roughly $727,000.
Most of that ether was subsequently forwarded to other wallets.
The last significant Ethereum receipt arrived around 13:06 UTC, well before the BNB Chain blacklist took effect.
Cysic has stated that the incident was isolated to the bridge’s message-processing and minting functions.
It did not affect the Cysic mainnet, consensus, block production, or EVM execution.
Existing user assets and CYS balances already held in wallets were not stolen or moved.
The foundation noted that the raw number of tokens minted does not itself represent the final dollar loss; transfers, swaps, and realized impact remain under review.
A follow-up report is expected once the current investigation phase concludes.
The bridge remains offline as a containment measure while the team conducts a comprehensive review of operational workflows, permissions, and asset records.
Cysic has warned users to ignore any messages claiming to offer compensation or recovery, stating that the project will never request seed phrases or private keys.
Cross-chain services through the affected bridge will stay unavailable until the security review is complete and reopening is formally announced.
The episode highlights ongoing risks in cross-chain infrastructure, where message-validation weaknesses have enabled unauthorized mints in multiple protocols this year. For Cysic users, the immediate effect is the temporary loss of bridge functionality, while the project’s core network and previously held assets appear unaffected.
