Cysic bridge forged mint hack — October 2026

The cross-chain bridge of Cysic, a compute network, minted 10 million CYS on BNB Chain on 17 October 2026 with no deposit behind them. This registry read the mint in block 128,170,791, at about 12:31 UTC. The Cysic Foundation’s preliminary report on X said the attacker had gained unauthorised access to a database serving bridge-related services and used a weakness in message processing to submit a forged mint instruction. It said consensus, block production and smart contracts on the Cysic mainnet were not affected and that no existing user balances were stolen.

According to CryptoTicker’s reconstruction, the attacker began selling at 12:36 UTC: about 5.65 million CYS for 588,315 USDT, then about 1.55 million CYS for about 220 BNB between 12:57 and 12:59 UTC. The proceeds were moved to Ethereum, where 306.52 ETH arrived in five transfers at 13:11 UTC. Cysic blacklisted the receiving address on BNB Chain at 13:47 UTC, 76 minutes after the mint, freezing the roughly 2.8 million CYS still there. The headline is the realised amount: 588,315 USDT plus 220 BNB at CoinGecko’s 17 October price of $720.88, about $746,900. The ETH that reached Ethereum was worth about $742,000. The unsold tokens are not counted as a loss, and the blacklist recovers nothing, because the proceeds were already on Ethereum.

The loss fell on buyers and liquidity providers who swapped real USDT and BNB for unbacked CYS. On 19 October Cysic said all relayers remained paused, deposited CYS was safe in the bridge contracts, and the bridge would reopen after security checks. It has promised a second report on the verified damage, fund tracing and countermeasures.