- An attacker minted 10 million unauthorized CYS and reportedly sold 7.2 million.
- The blacklist froze 2.8 million CYS but did not restrict ether on Ethereum.
- Cysic says user wallet assets were not stolen; verified dollar losses remain undisclosed.
Cysic suspended cross-chain transfers after the Cysic bridge exploit created 10 million unauthorized CYS tokens on October 17. The attacker sold 7.2 million tokens before the project froze the remaining balance. Reported transaction records show approximately 306.6 ETH reached Ethereum, while the foundation said its mainnet and existing assets in user wallets were unaffected.
Cysic bridge exploit traced to fraudulent mint message
In its October 18 incident report, the foundation described unauthorized access to a database supporting bridge services. It said a processing flaw then allowed the attacker to submit a fraudulent mint message.
The unauthorized issuance occurred on BNB Chain at approximately 12:31 UTC. The project said the incident involved bridge message processing and minting, with the full attack path still under investigation.
Cysic develops hardware and a Layer 1 network for generating zero-knowledge proofs. Its bridge enables token transfers between its own chain and other networks.
The response to the Cysic bridge exploit included suspending transfers and appointing an unnamed security firm. Investigators are reviewing the incident and tracing funds, according to the foundation.
Token sales preceded blacklist as proceeds reached Ethereum
The attacker reportedly sold 5.65 million CYS for 588,315 USDT, followed by 1.55 million CYS for roughly 220 BNB. The sales concluded around 12:59 UTC, less than half an hour after the mint.
Proceeds from the Cysic bridge exploit moved through SWFT, Mayan and deBridge. Ethereum records cited in the reporting show combined receipts of approximately 306.6 ETH.
The address subsequently forwarded 306.52 ETH to a second wallet. The roughly $727,000 valuation reflects an October 18 ether price, rather than a verified final loss.
Cysic blacklisted the receiving address at approximately 13:47 UTC, 76 minutes after the unauthorized mint. That restriction froze 2.8 million CYS on BNB Chain but did not freeze ether held on Ethereum.
The foundation has not published verified dollar losses from the Cysic bridge exploit. It says the bridge will remain closed until its security review is complete, with a follow-up report planned.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
