Cysic halts bridge after attacker mints 10M CYS on BNB Chain

Cysic has switched off its cross-chain bridge after an attacker used a flaw in the bridge's message handling to mint 10 million CYS tokens on BNB Smart Chain without any backing. The project disclosed the incident in an X report on Sunday, 18 October, and said its preliminary findings point to unauthorised access to a database that supports the bridge, Cointelegraph reported.

What happened

CYS is the token that coordinates incentives in Cysic's compute network — for users, compute providers, governance participants and contributors, according to the project's tokenomics documentation. Like many multi-chain tokens, it relies on a bridge: when tokens are moved from one chain, the bridge processes a message and mints the matching amount on the other side.

In this case, the attacker managed to make the bridge mint tokens that had never been locked anywhere. All 10 million CYS went to a single address on BNB Smart Chain.

What Cysic says was — and wasn't — hit

• Scope: the team says the problem was limited to bridge message processing and minting. Its mainnet and other operational systems were not affected.
• User funds: "The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets," Cysic said.
• Losses: the project stresses that the 10 million figure does not by itself say how much money was lost. Transfers and swaps made with the minted tokens, and the actual damage, are still being reviewed.

Because about 2.8 million tokens were still at the attacker's address when it was frozen, the rest had already been moved on before the blacklist kicked in.

Why bridges keep getting hit

Bridges sit between chains and can create tokens out of thin air if their checks are bypassed, which makes them one of the most attractive targets in crypto. This case is a reminder that the weak point is not always the smart contract: here, it appears to have been off-chain infrastructure feeding the bridge. Hacks and exploits already cost the industry close to $1.2 billion in the third quarter, according to Hacken.

New to the topic? Our explainer on what a crypto bridge is and why bridges get hacked covers the main designs and the risks, and our DeFi primer explains how bridged tokens end up in trading pools.