Image Credit: cysic.xyz
- Cysic suspended its cross-chain bridge after an attacker minted 10 million CYS without authorization on BNB Smart Chain.
- Preliminary findings indicate unauthorized database access allowed a fraudulent mint message exploiting bridge processing flaws.
- Cysic restricted an address holding 2.8 million tokens and required a security review before reopening the bridge.
Cysic suspended its cross-chain bridge after an attacker minted 10 million CYS without authorization on BNB Smart Chain, the Cysic Foundation said. Its incident report dated the attack to Oct. 17 and said the financial impact remained under investigation.
Cysic Investigates Database Access and Fraudulent Messages
In its Oct. 18 report, the foundation said preliminary findings pointed to unauthorized access to a database supporting bridge services. An attacker then exploited a processing flaw to submit a fraudulent mint message.
Cysic said the incident affected the bridge’s message-processing and minting functions. It said its mainnet and other operational systems were unaffected, and existing assets in user wallets were not stolen or transferred without authorization.
The bridge normally supports transfers between Cysic’s network, BNB Smart Chain and Base, according to project documentation. Its documented process locks or burns tokens on the source network before minting or unlocking them at the destination.
Cysic Restricts Address Holding 2.8 Million Tokens
The foundation’s timeline places the unauthorized mint at 12:31:38 p.m. UTC on Oct. 17. It added the recipient address to the token contract’s blacklist at 1:47:52 p.m. UTC, approximately 76 minutes later.
About 2.8 million CYS remained at the address when transfers were restricted. The foundation said investigators were reviewing token movements and swaps, and cautioned that the amount minted did not establish the final dollar loss.
Cysic Requires Security Review Before Bridge Reopens
The foundation said it engaged an external security firm to investigate the attack and trace funds. Its review covers bridge message processing, permission settings and related asset records.
Cysic said the bridge would reopen only after the security review was complete. It planned a follow-up report covering verified losses, fund tracing and remediation results, without providing a reopening date.
