Cysic Cross-Chain Bridge Hack Leads to Unauthorized Minting of 10 Million CYS, $727,000 Drained

Cysic, a blockchain project, halted related services and launched an investigation after a cross-chain bridge hack led to the unauthorized minting of CYS tokens.

The Block reported on October 18 that the Cysic Foundation said 10 million CYS tokens were minted without authorization in a hack on BNB Chain on October 17. The attacker sold 7.2 million of those tokens and moved about $727,000 to the Ethereum network.

In an incident report, the foundation said the attacker gained unauthorized access to the database of a service supporting bridge operations. The attacker then exploited a flaw in message processing to submit fraudulent token-minting requests. That allowed a large amount of CYS to be minted without going through standard approval procedures.

On-chain records show the attacker sold 7.2 million CYS in multiple transactions immediately after the unauthorized minting. Of that amount, 5.65 million tokens were converted into about 588,315 USDT through 11 trades. The remaining 1.55 million tokens were sold for about 220 BNB. Some of the trades were routed through OKX's decentralized exchange aggregator and executed on platforms including PancakeSwap.

The attacker then used cross-chain protocols including SWFT, Mayan and deBridge to move the proceeds to Ethereum. The attacker obtained about 306.6 ETH in the process, worth about $727,000 at the time. Most of that Ether was then moved to a separate wallet.

Cysic blacklisted the attacker's address about 76 minutes after the initial breach. As a result, transfers of the remaining 2.8 million CYS held by the attacker were blocked. The measure applied only to CYS tokens on BNB Chain, however, and did not affect funds that had already been moved to the Ethereum network.

The Cysic Foundation said the incident was limited to the bridge's message-processing and token-minting functions and did not affect the Cysic mainnet. It added that existing user assets were not stolen.

The actual damage has not yet been finalized. Cysic said the number of unauthorized tokens minted does not necessarily equal the final loss in dollar terms. The project has hired an outside security firm to investigate the incident and trace the funds, and plans to keep the bridge offline until security checks are completed.

Cysic is developing hardware optimized for generating zero-knowledge proofs, or ZK proofs, and a Layer 1 blockchain network. Founded in 2022, it raised $6 million in a seed round led by Polychain Capital in 2023.