Quick answer: An attacker used the Cysic bridge to mint 10 million unbacked CYS on BNB Smart Chain at 12:31 UTC on Oct. 17, 2026, Cysic said on Oct. 18. On-chain data shows 7.2 million left the address before a 13:47 UTC blacklist froze the last 2.8 million. The bridge stays closed.
The Cysic bridge was used to mint 10 million unbacked CYS tokens on BNB Smart Chain on Oct. 17, 2026, and it remains shut. Cysic says user wallets and its mainnet were not touched, but on-chain data shows 7.2 million of the new tokens left the attacker’s address before it was frozen.
What happened to the Cysic bridge?
The Cysic Foundation published an incident report on X at 10:10 UTC on Oct. 18. According to the report, an attacker first gained access to a database used by services behind the bridge. Then the attacker exploited a flaw in the processing logic to submit a fake mint message.
That message created 10,000,000 CYS at 12:31:38 UTC on Oct. 17. CryptoVank checked the minting transaction directly on BNB Smart Chain. It shows a single transfer of exactly 10 million CYS from the zero address to the wallet Cysic named.
Cysic then added that wallet to the token’s blacklist at 13:47:52 UTC, in this on-chain transaction. The team also hired an outside security firm to trace the funds. Cointelegraph reported the same timeline.
How much of the minted CYS got out?
Cysic has not given a loss figure yet. It says the number of tokens minted “does not, by itself, represent the final loss in U.S. dollar terms.” So CryptoVank pulled the transfer logs for the attacker’s wallet, block by block, between the mint and the freeze.
The data tells a clear story:
- First move: the wallet began sending CYS out at 12:36 UTC, five minutes after the mint.
- Speed: it sent 7.2 million CYS in 26 transfers to three smart contracts. The last one landed at 12:59 UTC.
- Frozen balance: exactly 2.8 million CYS still sits in the wallet, matching Cysic’s report.
In other words, the attacker emptied 72% of the haul in 23 minutes. However, Cysic needed 76 minutes to freeze the address. The pattern fits fast selling through trading contracts, although Cysic says the swaps are still under review.
At the CoinGecko price of $0.1180 at 10:56 UTC on Oct. 18, the 7.2 million tokens that moved are worth about $850,000. That is a rough marker, not a confirmed loss. Selling that much at once also pushed the price down as it went.
Why the Cysic bridge mint matters for CYS holders
CYS fell from $0.1246 at 12:30 UTC to $0.1082 at 12:40 UTC, a 13% drop in ten minutes, CoinGecko data shows. Still, the token bounced. It reached $0.1321 by 21:15 UTC, above its pre-attack level.
The scale explains the bounce. The 10 million new tokens equal about 6.2% of the 160.8 million CYS in circulation, and the 7.2 million that escaped equal about 4.5%. That is painful, but it is far smaller than other recent unbacked mints.
For example, the Autheo THEO exploit on Oct. 13 minted 19 million tokens through a bridge and sank THEO 92%. Similarly, the Pirate Chain exploit minted about 20% of the ARRR supply. Cysic is the third case in a week where a bridge or protocol created tokens out of thin air.
Even so, the bigger picture for CYS is weak. The token traded at $0.1180 on Oct. 18, down 6.2% in 24 hours and 21.7% in seven days. It sits about 93% below its $1.78 peak from Aug. 15, 2026. Its market value is about $19 million.
The trade-off behind the freeze
The blacklist saved 2.8 million tokens. Yet it also shows how much control the team keeps over the CYS contract on BNB Smart Chain. For many holders, that power is a safety net. For others, it is a central point of failure.
The root cause adds to that debate. Cysic’s early findings do not point to a bug in the token contract itself. Instead, they point to a database behind its bridge services. Off-chain systems like that often get less attention in audits, even though they can still tell a contract to mint.
What to watch next
Cysic promised a follow-up report covering the verified loss, where the funds went and how it fixed the flaw. Until then, three points matter most:
- Bridge status: the bridge reopens only after the security review, and Cysic will announce it on official channels.
- The frozen 2.8M CYS: Cysic has not said whether it will burn them or handle them in another way.
- Scams: Cysic warns that it will never ask for a seed phrase or send “refund” links. Our guide on how to spot crypto scams covers the warning signs.
Cysic Bridge FAQ
Were user funds stolen in the Cysic bridge exploit?
Cysic says no existing CYS or other assets were taken from user wallets. The attacker created 10 million new CYS on BNB Smart Chain on Oct. 17, 2026, and the mainnet was not affected.
How many CYS tokens did the attacker move?
On-chain data reviewed by CryptoVank shows 7.2 million CYS left the minting address in 26 transfers between 12:36 and 12:59 UTC. The remaining 2.8 million were frozen by a blacklist at 13:47 UTC.
When will the Cysic bridge reopen?
Cysic has not given a date. The bridge stays closed until the security review is finished, and the team says it will announce reopening plans through its official channels.
Sources
- Cysic Foundation on X: incident report (Oct. 18, 2026)
- Cysic on X: bridge suspended pending security review
- Cointelegraph: Cysic crypto bridge halted after unauthorized mint of 10M CYS
- BscScan: 10M CYS minting transaction
- BscScan: blacklist transaction
- BscScan: CYS balance of the minting address
- CoinGecko: Cysic (CYS) price and supply data
This article is for information only and is not financial advice. Figures may change as Cysic’s investigation continues; always do your own research.
