Attack targeted bridge infrastructure
The incident did not involve a compromise of Cysic’s mainnet or a direct withdrawal from existing user wallets. Instead, it targeted the infrastructure that authorizes token creation when assets move between blockchains.
In its incident report, the Cysic Foundation said that the attacker gained unauthorized access to a database supporting the project’s bridge services. That access allowed the attacker to submit a fraudulent mint message, which the bridge processed as legitimate. The resulting transaction created 10 million CYS on BNB Smart Chain.
The mint transaction itself is visible onchain in the BNB Smart Chain transaction record. The record provides a direct view of the unauthorized token creation and illustrates the central weakness in the incident: the attacker did not need to alter the underlying blockchain. The exploit instead affected the middleware responsible for translating cross-chain instructions into token issuance.
Cysic said it suspended the bridge after identifying the attack and blacklisted the receiving address. That action froze the remaining 2.8 million CYS on BNB Chain, according to the foundation’s account. However, the intervention came after a substantial portion of the unauthorized supply had already been sold and converted into other assets.
Rapid sale put pressure on liquidity
The Block reported, based on its review of onchain records, that the attacker sold 7.2 million CYS within roughly 28 minutes of the mint. The sales generated approximately 588,315 USDT and 220 BNB.
That sequence shows why unauthorized minting attacks can become financially consequential within minutes. A malicious actor does not necessarily need to keep the newly created tokens. Selling a large quantity quickly can convert an invalid or inflated token balance into liquid assets before the project can halt transfers, identify the address or coordinate with trading venues.
The impact also depends on the available liquidity for the affected token. Selling millions of newly minted units can sharply disrupt market pricing and impose losses on other participants, even when the attacker’s eventual proceeds are far below the nominal value of the minted supply. The 10 million CYS created in this case therefore represented both a security breach and a potential market integrity problem.
The Block said the attacker routed the proceeds through several services, including SWFT, Mayan and deBridge. The funds were fragmented across bridging and swapping transactions before ultimately reaching Ethereum. In total, the attacker received approximately 306.6 ETH, valued at about $727,000 based on the pricing cited in the report.
An Ethereum transaction recorded by Etherscan shows one 41.05 ETH payout associated with the movement of the proceeds to Ethereum. That transaction is one part of the broader flow rather than the entire amount transferred.
Blacklisting has clear limits
Cysic blacklisted the receiving address 76 minutes after the initial exploit, according to the incident account. The timing was sufficient to stop the remaining CYS held on BNB Chain, but it could not reverse assets that had already been exchanged or bridged to another network.
This distinction is important for cross-chain systems. A blacklist applied on one chain can restrict a specific address or token balance in that environment, but it does not automatically control funds that have moved through a bridge, entered a decentralized exchange or arrived at a new wallet on another blockchain. Once the attacker converted CYS into USDT, BNB and ETH, the project’s ability to intervene became more limited.
The episode highlights the security gap between a blockchain’s core network and the services that connect it to other ecosystems. Cross-chain applications depend on databases, message relayers, signing systems and smart contracts. Each component can become an authorization point, and a failure in one layer may allow an attacker to create assets without compromising the chain’s consensus mechanism.
Review will determine reopening
Cysic said it had hired an unnamed security firm to investigate the breach, trace the funds and review the bridge before reopening it. The project also said it would publish a follow-up report with verified loss figures.
That review will be important beyond the immediate incident. It should establish how the attacker obtained access to the bridge-supporting database, why the fraudulent mint message passed validation and whether additional controls can separate database access from token issuance. It may also clarify whether the bridge’s design can support stronger limits on mint volume, delayed settlement or independent confirmation for unusually large transactions.
For developers and users, the incident offers a practical warning. A blockchain may preserve the integrity of its mainnet while an adjacent bridge service authorizes invalid assets. Cross-chain functionality can expand access to liquidity and applications, but it also adds operational dependencies that must be secured as carefully as the smart contracts themselves.
Jessica Jones is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Jessica Jones's usual length and in Jessica Jones's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 10/19/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.