Cysic suspends bridge after 10 million CYS are minted

Cysic’s cross-chain bridge, which moves tokens between blockchains, is suspended after an attacker used it to mint 10 million CYS on BNB Chain on Oct. 17. The attacker sold 7.2 million tokens and moved about $727,000 in proceeds to Ethereum before Cysic blacklisted the receiving address, according to The Block’s report on the incident.

The bridge remains offline while Cysic investigates, and the project has not yet confirmed its final dollar losses.

How did the attacker mint CYS?

The Cysic Foundation said preliminary findings indicate the attacker gained unauthorized access to a database used by services supporting the bridge, then exploited a weakness in message processing to submit a fraudulent mint message. The foundation’s account, reported by Cointelegraph, says the incident affected the bridge’s message-processing and minting functions.

The mint created new CYS on BNB Smart Chain. Cysic said its mainnet and existing user assets were not affected. The project has hired a security firm to investigate and trace the funds, but the attacker’s identity and the full attack path have not been established.

How much did the attacker move to Ethereum?

On-chain records reviewed by The Block show the attacker sold 7.2 million of the 10 million CYS, then used SWFT’s Bridgers, Mayan and deBridge to move proceeds across chains. The receiving address obtained about 306.6 ETH on Ethereum, valued at roughly $727,000 at Sunday’s ETH price cited in the report.

Cysic blacklisted the address about 76 minutes after the initial mint, leaving 2.8 million CYS there frozen. That blacklist applies to CYS on BNB Chain; it does not freeze the ETH already sent to Ethereum. The project has not stated that the $727,000 figure is its verified loss: it said the number of tokens minted does not by itself determine the final dollar impact.

When will the bridge reopen?

Cysic said the bridge will remain closed until a security review is complete. It has not given a reopening date, so people who rely on the bridge cannot use it while that review is underway.

The foundation plans to publish a follow-up report with verified losses and its efforts to trace funds. Until then, users have the project’s initial account of the incident, but not a final accounting of its financial impact or a confirmed explanation of how the database was accessed.

Sources

• The Block’s report on the incident — theblock.co
• Cointelegraph — cointelegraph.com