Cysic cross-chain bridge attacked, 10 million CYS tokens unauthorized minted on BNB Chain

October 18 - The Cysic Foundation announced that on October 17, a security incident occurred on its cross-chain bridge, where attackers unauthorizedly minted 10 million CYS on BNB Smart Chain. After detecting the anomaly, the project team suspended the cross-chain bridge, implemented on-chain blacklist restrictions on the relevant addresses, and hired a professional security firm to investigate the attack path and fund flows. Preliminary investigation shows that the attackers gained unauthorized access to the database used to support the cross-chain bridge service and exploited a vulnerability in the relevant processing logic to submit forged minting messages. This incident only affected the message processing and minting functions of the cross-chain bridge; the Cysic mainnet and other operational systems were not affected, and existing user assets were not stolen.

As of now, the relevant addresses still hold approximately 2.8 million CYS, which have been restricted from transfer. The project team stated that the minted amount of 10 million CYS does not equate to the final USD loss, and the actual loss and subsequent fund tracing results are still under verification. The cross-chain bridge will reopen after the security review is completed.