Syscoin bridge hack — June 2026

On 7 June 2026 an attacker exploited the Syscoin UTXO-to-NEVM bridge, causing the unauthorised release of 5 billion SYS on the UTXO side.

Syscoin's technical post-mortem describes the flaw as a cross-layer interpretation mismatch. The attacker crafted a burn transaction containing duplicate asset commitments pointing at the same output index, which Syscoin Core and the NEVM relay parsed differently. The relay accepted a proof for a burn that had not effectively taken place and authorised the corresponding release. Syscoin paused the bridge and coordinated with exchanges and partners to freeze the tokens before they could reach open markets.

The commonly cited loss is about $10 million, and that figure needs care. SYS traded at roughly $0.00168 on the day of the incident, and the entire legitimate circulating supply of about 890 million SYS carried a market capitalisation near $1.5 million. Five billion SYS at that spot price works out to roughly $8.4 million, but the released tokens were more than five times the whole circulating supply, so no such value could have been realised in the market. Published figures do not explain their methodology.

No value was in fact extracted. According to the post-mortem the attacker returned all 5 billion SYS to a recovery address published by Syscoin, and the recovered tokens were burned via an OP_RETURN transaction, permanently removing them from supply. Syscoin says no user funds were lost and the bridge remained paused pending final review. No bounty or negotiated settlement has been reported.