# Cysic shuts bridge after unauthorized mint of 10 million CYS Author: Hatice Ertaş Language: English Published: 2026-10-18T15:24:17+03:00 Updated: 2026-10-18T15:24:17+03:00 ![Two separated optical coupling assemblies representing the suspension of the Cysic bridge](https://kriptometa.com/uploads/cysic-milyon-cys-in-izinsiz-uretimi-sonrasi-kopruyu-kapatti-9f7678acc868_article.webp) ## Key takeaways - The incident occurred on October 17; the foundation published its report on October 18. - The team says existing user assets were not stolen and mainnet operations were unaffected. - The bridge will remain closed until its security review is complete. Cysic Foundation’s incident report says preliminary findings point to unauthorized database access and a fraudulent mint message. The team has not set a date for reopening the bridge. Cysic has suspended its cross-chain bridge after 10 million CYS were minted without authorization on BNB Smart Chain. In an [incident report published on October 18](https://x.com/cysic_fdn/article/2111761749116637687), Cysic Foundation said the previous day’s attack was confined to the bridge’s message processing and [token](https://kriptometa.com/en/glossary/coin-vs-token) minting functions. The foundation’s preliminary findings indicate that the attacker gained unauthorized access to a database used by services supporting the bridge. A flaw in the associated processing logic then allowed a fraudulent mint message to be submitted. The full attack path and root cause remain under investigation. The report gives 12:31:38 UTC on October 17 for the [unauthorized mint](https://bscscan.com/tx/0x8de43ba77f9a14ecff1268acb9d7c9bf3afe1f2a45bd8d8681d824a2460000f6) and 13:47:52 UTC the same day for the [recipient address being blacklisted](https://bscscan.com/tx/0x3ed213fecbc9e9e4cc87b557e6d605414797e904a6e6b1ee6f2f0aff2e9850c7). The two recorded times are 1 hour, 16 minutes and 14 seconds apart. According to the foundation, the address restriction was applied through the [CYS token contract](https://kriptometa.com/en/glossary/smart-contract) on BNB Smart Chain. ## 2.8 million CYS remain under transfer restrictions The foundation said approximately 2.8 million CYS remained at the [recipient address](https://kriptometa.com/en/glossary/wallet-address) when it reported the incident, with transfers of those tokens restricted. Subsequent transfers and swaps of the minted tokens are still being reviewed. The statement does not say that all 10 million tokens were frozen or recovered. **No final dollar loss has been disclosed.** The 10 million CYS minted without authorization does not, by itself, measure the financial damage. The foundation says a follow-up report will give verified loss figures. Cysic said it had engaged a security firm to investigate the addresses involved and trace the funds, without naming the firm. The review also covers bridge message processing, permission settings and related asset records. Sensitive findings concerning the attacker’s identity will be disclosed only where that would not compromise the investigation, according to the report. ## The team says mainnet operations are unaffected [Cysic’s technical documentation](https://docs.cysic.xyz/) describes infrastructure that matches computing tasks with hardware providers and verifiers, including the generation and verification of [zero-knowledge proofs](https://kriptometa.com/en/glossary/zero-knowledge-proof). The incident report says the attack did not affect mainnet consensus, block production, transaction confirmation or EVM transaction execution. The foundation also says existing CYS and other assets held in user wallets were neither stolen nor transferred without authorization. Users cannot make cross-chain transfers through the suspended Cysic bridge. The foundation says it will reopen only after a security review of the entire workflow is complete. A reopening schedule and the results of remediation and validation are to be announced through its official channels. [Cysic’s October 18 bridge suspension announcement, linking to the incident report](https://x.com/cysic_xyz/status/2111769101723218106)