An attacker exploited Cysic’s cross-chain bridge on Saturday, October 17, 2026, created 10 million unauthorised CYS tokens on BNB Smart Chain, and the wallet then sold 7.2 million of those tokens and transferred roughly $727,000 in proceeds to Ethereum before the project could fully contain the damage.
Cysic suspended the bridge shortly afterward and blacklisted the recipient address, freezing the remaining 2.8 million tokens.
How Did the Attacker Mint the Unbacked CYS Tokens?
Preliminary findings from the Cysic Foundation point to unauthorised access of a database that supported the bridge.
The attacker then exploited a flaw in the message-processing logic and submitted a fraudulent mint request.
That action produced 10 million CYS at 12:31 UTC without any corresponding locked assets on the source side.
On-chain records confirm the tokens appeared in a single receiving address that immediately began distributing them.
Existing user holdings and the Cysic mainnet stayed untouched throughout the incident.
What Happened to the Stolen Proceeds on Ethereum?
Within minutes, the attacker started selling. Between roughly 12:36 and 12:59 UTC the wallet moved 7.2 million CYS across multiple swaps, mostly through OKX’s aggregator and PancakeSwap.
The sales generated about 306.6 ETH. Those funds then crossed to Ethereum through several bridges, including Mayan, deBridge and SWFT’s Bridgers.
By the time Cysic acted, the majority of the liquid value had already left BNB Chain and sat on Ethereum.
Ethereum Involvement; How Quickly Did Cysic Respond to the Bridge Exploit?
The project detected unusual activity and activated its response procedures. At 13:47 UTC—76 minutes after the mint—Cysic added the recipient address to the CYS token contract’s on-chain blacklist.
That step locked the remaining 2.8 million tokens and prevented further transfers from the address.
The foundation also paused the bridge entirely and brought in an external security firm to trace the funds and map the full attack path.
What Does This Incident Mean for Cross-Chain Security?
Bridge exploits remain one of the most persistent risks in crypto. Even when a project freezes remaining tokens, the portion already sold and moved across chains often escapes recovery.
In this case, the attacker converted most of the minted supply into and shifted it to Ethereum before the blacklist took effect.
The episode shows the narrow window teams face once an unauthorised mint occurs and the continued need for tighter controls around message validation and supporting infrastructure.
Cysic continues its investigation while the bridge stays offline. For now, the $727,000 moved to Ethereum stands as the clearest realised value extracted from the 10 million unbacked tokens.
