Cysic bridge: forged mint of 10M CYS after database access; ≈$727K moved
Update
Full amount laundered; Cysic will burn 7.2M CYS
23 Oct: Onchain Lens says the exploiter laundered about $743K through Tornado Cash and that the full amount is now through.
2M CYS from Foundation Reserves by the end of October to offset the unauthorised mint. A verified dollar loss from Cysic is still unpublished.
Update
10% bounty offered; exploiter sent about 300 ETH to Tornado Cash
22 Oct: Cysic offered the exploiter 10% to return 90% of the identified ETH within 72 hours. 4 BNB (about $23K) into Tornado Cash. A verified dollar loss from Cysic is still unpublished.
Update
Compensation planned through token emissions; loss figure still unpublished
21 Oct: Cysic says it is still investigating the 17 Oct incident and plans to address the impact through token emissions. A detailed update is promised in the coming days. The bridge stays suspended.
Cysic says pending transfers remain in the bridge contract. Still no verified USD loss figure. AMA remains 22 Oct 12:30 UTC.
Update
Relayers still paused; deposited CYS called secure; no verified loss yet
20 Oct: Cysic Foundation says all relayers remain paused, deposited CYS remains in bridge contracts, and reopening waits on security checks.
Pending bridge transactions will be processed when the bridge reopens. Still no verified USD loss figure from Cysic. Community AMA is set for 22 Oct 12:30 UTC.
Update
ExVul joins investigation; hardening before reopen; no verified loss yet
19 Oct: security firm ExVul says it is jointly investigating with Cysic (attack path, on-chain tracing, and hardening before the bridge reopens). 8M CYS remain at the blacklisted address.
Cysic has not yet published a verified USD loss figure; the ≈$727K ETH figure remains third-party tracing from The Block. Bridge still closed.
17 Oct 2026: Cysic Foundation says an attacker gained unauthorized access to a database used by bridge-supporting services and submitted a fraudulent mint message, creating 10M unbacked CYS on BNB Smart Chain.
6 ETH (≈$727K) moved to Ethereum. 8M CYS were blacklisted on BNB Chain. Bridge closed pending review; Cysic says mainnet and existing user wallets were not drained. Final USD loss not yet stated by the project. No SlowMist row at our check.
Research snapshot from Cysic and The Block.
369 take
Bridge mint authority behind a supporting database is a hot trust surface. Ignore fake refund or safe-account links.
Wait for Cysic's verified loss figure; 10M minted is a token count, not the final dollar loss.
Sources