An attacker exploited a vulnerability in Cysic’s cross-chain bridge to mint 10 million CYS on BNB Chain and sell 7.2 million of them, prompting the project to shut down the bridge and block transfers of the remaining tokens.
The Cysic Foundation said unauthorized access was gained to a database used by services supporting the bridge in Saturday’s attack. A vulnerability in the transaction logic was used to send a fake token minting message, allowing the attacker to illegally mint 10 million CYS.
Cysic is a project that develops hardware for generating zero-knowledge proofs and operates its own blockchain. The bridge that was attacked allows tokens, including CYS, to move between the Cysic network and networks such as BNB Smart Chain and Base.
Sold Tokens Before They Were Frozen
According to on-chain records reviewed by The Block, the attacker began selling five minutes after minting the tokens. Within 23 minutes, the attacker sold 7.2 million CYS in 15 transactions.
In the first round, the attacker received 588,315 USDT in exchange for 5.65 million CYS; in the second, approximately 220 BNB for 1.55 million CYS. Cysic blacklisted the address 76 minutes after the initial attack transaction and 48 minutes after the sales were completed.
The blacklist decision blocked transfers of the 2.8 million CYS remaining in the attacker’s possession. However, a significant portion of the sale proceeds had already been moved to another network by then.
Approximately 307 Ethereum Moved to Another Network
As a result of transactions through SWFT, Mayan, and deBridge, the attacker received a total of 306.6 ETH on the Ethereum network. At the ETH price of around $2,372 cited by the source report on Sunday, this amounted to $727,000. The attacker then sent 306.52 ETH to another wallet.
Cysic’s blacklist decision applies to CYS tokens on BNB Chain; ETH moved to the Ethereum network is not covered by this restriction. The foundation has not yet disclosed the verified total dollar loss.
Bridge to Remain Closed Until Security Review Is Complete
According to the foundation’s statement, the attack was limited to the bridge’s message processing and token minting functions; the Cysic mainnet was unaffected, and existing user assets were not stolen. The team said it had engaged a security firm to track the funds and investigate the incident.
The bridge will remain closed until the security review is complete. Cysic plans to publish an additional report on confirmed losses and developments in tracking the funds.
Not investment advice.