ZK proving network Cysic has suspended its cross-chain bridge after an attacker exploited the bridge’s message-processing logic to mint 10 million CYS tokens on BNB Smart Chain. In an official incident report published Sunday, the Cysic Foundation said the unauthorized mint occurred at 12:31:38 UTC on October 17 and that it froze the receiving address roughly 76 minutes later.
Preliminary findings point to unauthorized access to a database that supports bridge services, combined with a vulnerability in the processing logic that let the attacker submit a fraudulent mint message. Cysic said the full attack path and root cause remain under investigation, and that a security firm has been engaged to trace the funds.
About 7.2 Million Tokens Moved Before the Freeze
The recipient address was added to the CYS token contract’s blacklist at 13:47:52 UTC on October 17. By then only about 2.8 million of the 10 million minted tokens remained there, meaning roughly 7.2 million CYS, about 72% of the unauthorized mint, had already moved to other addresses before the restriction took effect.
That gap is the core of the holder-facing risk. Ten million tokens equals 1% of CYS’s 1 billion maximum supply and a proportionally larger share of the tokens actually in circulation, so the incident adds supply that was never scheduled to exist. Cysic cautioned that the number of tokens minted does not by itself establish the final dollar loss, and that transfers, swaps and realized losses remain under review.
What the Incident Did Not Reach
Cysic said the incident was confined to the bridge’s message-processing and minting functions. Existing user assets were not stolen, and the mainnet, including consensus, block production and EVM execution, was unaffected. The bridge itself remains closed indefinitely and will reopen only after a full security review of its workflow is complete.
What Happens Next
The foundation plans to publish a follow-up report after the current investigation phase, covering the verified impact, actual losses, fund-tracing progress and remediation results. Until the bridge reopens, users cannot move CYS across chains through the service, and no timeline has been given for its return. The episode is the latest reminder that cross-chain bridges remain a concentrated attack surface, following Fetch.ai’s SingularityNET bridge exploit in September and the broader pattern documented in our blockchain security guide.
