Cysic has suspended its cross-chain bridge after someone minted 10 million CYS tokens on BNB Smart Chain without authorization on October 17, 2026.
Cysic described the incident as limited to bridge message processing and minting. It said the mainnet and its other operational systems were unaffected. The bridge, however, is offline indefinitely, and no timeline has been given for its return.
What happened on the bridge
The unauthorized mint took place at 12:31:38 UTC on October 17. By 13:47:52 UTC the same day, Cysic had blacklisted the address that received the tokens.
At the time of the blacklisting, approximately 2.8 million of the minted CYS sat in that address. That means most of the 10 million tokens were no longer in the frozen wallet when the freeze landed.
Cysic has brought in third-party security experts to investigate. They are also tracking where the exploited tokens go and whether they get swapped.
Early findings point to a potential link between the breach and unauthorized database access, along with weaknesses in the bridge’s processing logic. Cysic has not confirmed the full attack vector or the root cause. Both are still under evaluation.
Why bridge minting is the weak spot
This is not a new failure mode. Syscoin suffered a similar bridge mint exploit in June 2026. Incidents like these keep pointing to the same weakness: minting functions without strong enough safeguards around them.
CYS has a maximum supply of 1 billion tokens. Around 160.8 million were in circulation following the token generation event. Against that circulating figure, 10 million unauthorized tokens is a meaningful addition of supply.
Cysic’s road to this point
Cysic runs a dual-token model. CYS is the utility token. CGT handles governance and is obtained through staking. The bridge incident involved CYS, and Cysic has not reported any impact on CGT.
The project launched its mainnet and held the CYS token generation event in December 2025. That came after a funding round and a series of testnets. The launch drew some criticism over how TGE tokens were distributed and over financial transparency.
The October incident is the first notable operational security problem tied to Cysic’s bridge infrastructure.
What this means for CYS holders and bridge users
Holders face an immediate dilution question. Ten million tokens were created outside the intended process. Only approximately 2.8 million of them are confirmed frozen.
Bridge users cannot move CYS across chains through Cysic’s bridge until it reopens, and there is no date for that.
The investigation’s early direction also deserves attention. A possible link to unauthorized database access would suggest the weakness may have been in off-chain systems feeding the bridge, not only in smart contract code. If confirmed, that would expand the security conversation beyond audits of on-chain contracts to cover how bridge operators protect their own back-end systems.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.