Cysic Bridge Unbacked CYS Mint

On October 17, 2026, an attacker abused the Cysic cross-chain bridge to mint 10 million unbacked CYS on BNB Chain and dumped most of it within minutes, netting about 306.6 ETH — roughly $727,000 — before the project could blacklist the stolen tokens. Nothing was locked on the other side to back the new supply, making this an unbacked-minting exploit rather than a drained liquidity pool.

What happened

Cysic's preliminary findings say the attacker gained unauthorized access to a database used by services that support the bridge, then exploited a flaw in the bridge's message-processing logic to submit a fraudulent mint instruction. At 12:31:38 UTC, the bridge minted 10,000,000 CYS on BNB Chain with no corresponding deposit locked elsewhere — equal to about 6.2% of the circulating supply and 1% of the 1 billion maximum.

The attacker moved fast. Between 12:36 and 12:59 UTC, they sold 7.2 million CYS across 15 transactions, twelve of them routed through OKX's DEX aggregator with fills on venues including PancakeSwap, first for about 588,315 USDT and then for roughly 220 BNB. The proceeds were pushed cross-chain to Ethereum through Mayan, deBridge and SWFT, arriving as about 306.6 ETH that was then forwarded in five transfers to a second wallet (0x1106De394da07e90b02161465EA0421B74DB4691) by 13:11 UTC. Cysic blacklisted the receiving address on the CYS contract at 13:47:52 UTC — 76 minutes after the mint, by which point roughly 72% of the illicit supply had already left the address.

Aftermath

Cysic published an incident report on October 18, saying the damage was limited to the bridge's minting and message-processing functions and did not touch its mainnet, other operational systems, or user wallets. About 2.8 million CYS remain frozen at the attacker's address via the blacklist, but that control applies only to CYS on BNB Chain and could not reach the ETH, which had already been forwarded. The project suspended the bridge pending a full security review, engaged an outside firm to trace the funds, and promised a follow-up report on verified losses. No funds had been recovered. CYS fell to an all-time low of $0.1076 on the day, some 93% below its August 2026 peak.

Why it matters

Cysic is the third unbacked-mint exploit in a single week, after Autheo, where a trusted relayer key minted 19 million THEO through a Hyperlane bridge, and Pirate Chain, whose exploit conjured 39.8 million ARRR out of thin air. In each case the attacker did not have to break cryptography or drain a vault — they only had to convince the minting path that a non-existent deposit was real. A blacklist can quarantine the newly minted tokens, as it did here, but it is useless once the value has been swapped for a liquid asset like ETH and bridged away. The enduring lesson from the Wormhole and Meter era holds: a bridge's mint function is its most dangerous surface, because an authorization gap there prints money directly.