Cysic Bridge Attacker Mints 10M CYS, Moves $727K to Ethereum
What happened: On October 18, an attacker exploited Cysic bridge’s message-processing logic to mint 10 million unauthorized CYS tokens on BNB Smart Chain, selling 7.
What happened: On October 18, an attacker exploited Cysic bridge’s message-processing logic to mint 10 million unauthorized CYS tokens on BNB Smart Chain, selling 7.2 million and bridging approximately $727,000 (306.6 ETH) to Ethereum using SWFT Bridgers, Mayan, and deBridge. Cysic responded by blacklisting the attacker’s wallet within 76 minutes and freezing the remaining 2.8 million CYS. The foundation stated that user assets were not stolen and that the exploit targeted off-chain infrastructure rather than smart contracts.
Why it matters: This incident highlights the growing risk of off-chain infrastructure vulnerabilities in cross-chain bridges, as attackers increasingly target trusted-messenger systems rather than on-chain code. Cysic’s rapid response limited the financial damage, but the exploit underscores the need for more robust security practices in the bridge ecosystem, especially as cross-chain activity grows.
Source: The Block