By Hamza Faisal

Cysic has suspended its cross-chain bridge after an attacker printed 10 million unauthorized CYS tokens on BNB Chain and escaped with roughly $727,000 before the project blacklisted the receiving address.

The mint landed at 8:31 a.m. ET on Saturday, according to onchain data reviewed by The Block. Within five minutes, the attacker's wallet started moving the freshly minted tokens, offloading 7.2 million CYS across 15 transactions before 8:59 a.m. The proceeds were then bridged off BNB Chain in a rapid laundering sequence: 100,000 USDT routed through SWFT, 488,315 USDT split across six Mayan transfers, and 219 BNB moved through Mayan and deBridge. In total, the attacker collected about 306.6 ETH on Ethereum, worth around $727,000 at Sunday's prices.

A database breach behind the mint

According to an incident report the Cysic Foundation posted to X on Sunday, the attacker gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in its processing logic to submit a fraudulent mint message. Cysic said the flaw was confined to the bridge's message-processing and minting functions and did not touch the mainnet, adding that existing user assets were not stolen.

Cysic, founded in 2022, builds specialized hardware and operates a Layer 1 network for generating zero-knowledge proofs. Its bridge shuttles tokens, including CYS, between the Cysic chain and networks such as BNB Smart Chain and Base. The company raised a $6 million seed round led by Polychain Capital in 2023.

Blacklist landed 76 minutes later

Onchain records show Cysic added the recipient address to the token contract's blacklist roughly 76 minutes after the mint, at 13:47 UTC. About 2.8 million CYS — 28 percent of the unauthorized issuance — remained parked at that address and was frozen. The blacklist applies only to CYS on BNB Chain; the 306.6 ETH already sitting on Ethereum is outside its reach.

The 10 million tokens represent one percent of CYS's one-billion maximum supply, a sudden supply shock that token holders will feel in market pricing. Cysic has not disclosed a verified dollar figure for its own losses, noting that the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms."

Bridge stays dark pending review

Cysic said the bridge will remain closed until a security review is complete, and it has tasked an unnamed security firm with investigating the attack and tracing the funds. A follow-up report on verified losses is expected. The incident is the latest reminder that the most fragile point in crypto infrastructure is rarely the chain itself — it is the off-chain plumbing that holds bridges together.

By Hamza Faisal