In this article4 sections
Cysic suspended its cross-chain bridge after an attacker minted 10 million CYS tokens on BNB Smart Chain without authorization, Cointelegraph reported on October 18, 2026. The mint occurred at 12:31:38 UTC on Saturday, and Cysic added the receiving address to the token contract’s blacklist at 13:47:52 UTC the same day.
The company said in a Sunday incident report on X that preliminary findings point to unauthorized access to a database supporting the bridge. Cysic said the incident was limited to bridge message processing and minting and did not affect the mainnet or other operational systems.
Also read: BitMine Buys 15,112 ETH, Treasury Reaches 6,016,414 Tokens
Key facts
- About 2.8 million of the minted CYS remained at the blacklisted address when transfers were restricted; the rest had already left the wallet.
- Cysic said the mint size alone does not establish the dollar value of losses, with transfers, swaps and actual losses still under review.
- The company has hired a security firm and plans a follow-up report once the current investigation phase ends.
- Cryptobriefing reported the bridge is offline indefinitely with no timeline for reopening.
- CYS has a maximum supply of 1 billion tokens, with roughly 160.8 million in circulation after the token generation event, per Cryptobriefing.
What Cysic says happened
Cysic stated that existing CYS and other assets in user wallets were not stolen or transferred without authorization as a result of the incident. The company has not confirmed the full attack vector or root cause, according to Cryptobriefing, which reported that early findings also point to weaknesses in the bridge’s processing logic.
Cryptobriefing reported that the incident was the first notable operational security problem tied to Cysic’s bridge infrastructure. The project launched its mainnet and held its CYS token generation event in December 2025, following a funding round and a series of testnets. The launch drew some criticism over how TGE tokens were distributed and over financial transparency.
Also read: EU issuers push MiCA-regulated dollar stablecoins alongside euro tokens
Why it matters
The unauthorized supply landed in a token with a fixed 1 billion maximum, and Cryptobriefing framed 10 million tokens as a meaningful addition against the circulating figure. Holders therefore face a dilution question that the blacklist only partly addresses, since most of the tokens had moved before the freeze.
Bridge users cannot move CYS across chains through Cysic’s bridge until it reopens, and no reopening date has been given. The early investigative direction also matters: a link to unauthorized database access would point to off-chain systems feeding the bridge rather than smart contract code alone, widening the security question beyond contract audits. Cryptobriefing noted a comparable bridge mint exploit at Syscoin in June 2026, and reported no impact on CGT, the governance token in Cysic’s dual-token model.
What to watch
Cysic’s promised follow-up report, issued after the current investigation phase, is the next concrete checkpoint. Its findings on the attack vector, the fate of the unfrozen tokens and the bridge’s reopening schedule will determine how holders and bridge users are affected.
Reported by cointelegraph.com.
Sources: Cointelegraph, Cryptobriefing