Cysic has taken its blockchain to another, usually by locking the assets on the source chain and issuing an equivalent token on the destination chain, or by using liquidity on both sides.">cross-chain bridge offline after an attacker minted 10 million CYS tokens on BNB Smart Chain on Saturday 17 October. The mint took place at 12:31:38 UTC. The receiving address was blacklisted in the token contract at 13:47:52 UTC, 76 minutes later, with about 2.8 million CYS still in it. That is the account given in Cysic’s incident report on X, as relayed on 18 October by Cointelegraph, Crypto Briefing, ChainCatcher and GNcrypto. Coindaro could not load the post itself, and the on-chain data were not checked independently.
Cysic, a zero-knowledge computing project, says its preliminary findings point to unauthorised access to the database that supports the bridge. Existing balances in user wallets were not touched, it says. The real cost of the Cysic bridge exploit is still unknown: by Cysic’s own account, the minted amount alone does not determine the loss in dollars.
Cysic bridge exploit: 76 minutes between the mint and the freeze
The timeline in Cysic’s report is short and precise. All times are UTC on Saturday 17 October, as reported by Cointelegraph, Crypto Briefing, ChainCatcher and GNcrypto:
- 12:31:38: 10,000,000 CYS are minted on BNB Smart Chain through the bridge, without authorisation.
- 13:47:52: the recipient address is added to the blacklist of the CYS token contract, which stops it from sending tokens. About 2.8 million CYS were still there, and they remain frozen.
None of the reports we read gives the time the bridge itself was paused. The summary of a KuCoin news flash, time-stamped 11:22 on 18 October with no time zone, reads as if the bridge stopped at 12:31:38. Its own body text only says the bridge has since been suspended, and the other outlets give that time for the mint alone. We treat the pause time as unknown.
According to Cysic, the incident was confined to the bridge’s message processing and minting, and its mainnet and other operational systems kept working. Its central reassurance, quoted by Cointelegraph, is that the incident “did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets”. Crypto Briefing notes that no impact has been reported on CGT, the governance token that holders receive when they stake CYS.
Why 10 million CYS is not the size of the loss
Freshly minted tokens with no backing only turn into a loss for someone when they are sold for something real. Cysic’s figures allow a simple subtraction: 10 million minted, about 2.8 million frozen, so roughly 7.2 million CYS left the address before the blacklist. That 7.2 million is our arithmetic, not a figure Cysic has published. It says nothing about where those tokens went next.
The Defiant reports that on-chain records show some tokens were sold before the freeze. How many, into which pools or on which exchanges, nobody has said. Cysic told the outlets that transfers, swaps and actual losses are still under review. No source we found had published the mint transaction hash or the recipient address by midday on Sunday.
Prices give an order of magnitude, nothing more. GeckoTerminal showed CYS at $0.1174 on BNB Smart Chain at 12:13 UTC on 18 October, and CoinGecko had $0.1175 a minute earlier. At $0.1174, 10 million CYS would be worth about $1.17 million, the 2.8 million frozen about $0.33 million and the 7.2 million that moved about $0.85 million. Those are theoretical values at a Sunday price, not the amount anyone pocketed.
| Item | Figure | Source |
|---|---|---|
| CYS minted without authorisation | 10,000,000 on BNB Smart Chain | Cysic report, via Cointelegraph |
| Mint time | 12:31:38 UTC, 17 Oct | Cysic report, via Cointelegraph, Crypto Briefing, ChainCatcher, GNcrypto |
| Blacklist time | 13:47:52 UTC, 17 Oct (76 min 14 s later) | Same |
| Frozen at the recipient address | about 2.8 million CYS (28%) | Cysic report, via Cointelegraph and The Defiant |
| Moved before the freeze | about 7.2 million CYS | Coindaro arithmetic (10M minus 2.8M) |
| CYS price before the mint | $0.1253 at 12:00 UTC, 17 Oct | CoinGecko hourly data |
| All-time low | $0.1063 at 12:38 UTC, 17 Oct | CoinGecko |
| CYS price on Sunday | $0.1174 at 12:13 UTC, 18 Oct | GeckoTerminal |
| Value of 10M CYS at that price | about $1.17 million (theoretical) | Coindaro arithmetic |
| Circulating supply | about 160.8 million CYS | CoinGecko, 18 Oct |
| Maximum supply | 1 billion CYS | Cysic Foundation docs |
Measured against supply, 10 million CYS is about 6.2% of the roughly 160.8 million in circulation according to CoinGecko, and 1% of the 1 billion maximum set out in the Cysic Foundation tokenomics.
CYS price hit an all-time low seven minutes after the mint
CoinGecko’s hourly prices put CYS at $0.1253 at 12:00 UTC on Saturday, half an hour before the mint. The site records the token’s all-time low, $0.1063, at 12:38 UTC, seven minutes after the mint and about 15% below that noon level. The hourly price was $0.1092 at 13:00 UTC and back at $0.1169 by 14:00 UTC, while the address was already frozen.
The timing fits The Defiant’s report of sales before the blacklist. No source has tied that low to specific transactions, though, and a thinly traded token can move this much on a single large order.
On Sunday at 12:12 UTC, CoinGecko showed CYS 5.95% lower over 24 hours and 21.7% lower over seven days, for a market value of about $18.9 million. Much of that weekly loss came before the exploit. CYS traded at $0.1533 at 12:00 UTC on 10 October and at $0.1253 a week later, about 18% lower, by the same hourly data.
Liquidity matters for what comes next. Most CYS trading on BNB Smart Chain runs through one CYS/USDC smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool on PancakeSwap, which GeckoTerminal showed with about $899,000 in reserves and $6.2 million of volume over 24 hours at 12:13 UTC on Sunday. The 7.2 million CYS that left the address are worth about as much as that whole pool. Our reading, which is an inference and not a finding: selling all of them there within an hour would most likely have pushed the price far below the recorded low. So part of the tokens probably went somewhere else (an exchange deposit, another chain) or has not been sold. Which of these happened is not known.
What a bridge mint exploit is, for newcomers
A cross-chain bridge moves a token between two blockchains. In the usual design, the token is locked or burned on the first chain, a message records that event, and a contract on the second chain mints the same amount. The minted tokens are worth something only because the locked ones stand behind them.
A bridge mint exploit breaks that link. If an attacker can forge the message, or take control of whatever produces it (a validator key, a relayer or, in Cysic’s case by its preliminary account, a database), the contract on the destination chain mints tokens with nothing behind them. The smart contract may work exactly as written. The input is what is false.
The blacklist that limited the damage here is a separate feature. Some token contracts let the issuer block an address from moving tokens. It is what kept 2.8 million CYS in place on Saturday, and it is also a form of central control that holders accept when they buy such a token.
Earlier bridge mints, from Qubit to BNB Chain
Next to the 2022 bridge attacks, Cysic is a small case. Those followed the same pattern at a far larger scale:
- Qubit Finance, late January 2022: the attacker used a legacy deposit function to mint qXETH on BNB Smart Chain without depositing any ETH, then borrowed against it, for a loss of about $80 million.
- Wormhole, 2 February 2022: spoofed guardian signatures let the attacker mint 120,000 wrapped ETH on Solana with no collateral behind them, worth about $320 million at the time.
- Nomad, 1 August 2022: a routine upgrade marked a zero value as a trusted root, so unproven messages passed as valid; more than 300 addresses copied the attack and took about $190 million, according to The Block.
- BNB Chain Token Hub, 6 October 2022: a forged proof minted 2 million BNB, about $566 million on paper. Validators halted the chain, and only about $137 million reached other chains according to Nansen; The Block put it at $100 million to $130 million.
The BNB Chain case is the closest to Cysic’s. What decided the real damage was not the minted amount but how much the attacker could get out before the freeze.
This is also the third unbacked mint Coindaro has covered in three days. The Pirate Chain bug that minted 39.8 million ARRR came on 16 October, and the NEAR Intents deposit-notification bug created $3.8 million of ghost funds the next day. No source links these incidents: the mechanisms differ, and so do the projects.
What Cysic is and what happens next
Cysic began as a hardware company for zero-knowledge proofs, building FPGA-based accelerators for the heavy maths behind them, with a dedicated chip as the end goal. It raised a $6 million seed round led by Polychain Capital, closed in December 2022 and announced on 17 February 2023, according to The Block. Its CoinGecko page now describes it as a full-stack compute network that turns GPUs, ASICs and computing power into yield-bearing assets.
The CYS token launched on 11 December 2025, with spot trading on KuCoin from 10:00 UTC that day. According to Cysic’s docs, 40.19% of the 1 billion supply goes to ecosystem incentives and 23.62% to investors, whose tokens unlock after a one-year cliff and then over 12 months. The docs do not say when the cliff starts; if it runs from the December 2025 launch, investor tokens would begin to vest around December 2026. CoinGecko lists CYS contracts on BNB Smart Chain, where the exploit was reported, and on Base. No source has said whether Base or any other network saw unauthorised mints.
Cysic says it has brought in a security firm, which it has not named, and will publish a follow-up report once the current investigation phase is over. A network upgrade to stop a repeat is under review, according to the KuCoin flash. The bridge stays offline, “indefinitely” in Crypto Briefing’s words, with no restart date.
The open questions for CYS holders
Several things the market needs to price the damage are still missing. Nobody has published the mint transaction or the attacker’s address, so the path of the 7.2 million tokens cannot be traced in public. Coindaro found no alert from PeckShield, CertiK or Cyvers. No exchange has announced a freeze on CYS deposits, and Cysic has said nothing about compensation, a bounty offer or how the database was reached.
Holders who did not use the bridge on Saturday are, on Cysic’s account, not directly exposed: their balances were not touched. What they carry is the dilution from whatever part of the 7.2 million gets sold. Cysic’s follow-up report, promised for after the investigation with no date attached, is the next document to watch.