A hacker printed 10 million CYS through Cysic's bridge, and 7.2 million of them are still unaccounted for

Cysic, whose CYS token is used to reserve computing power for zero-knowledge proofs and AI work, has suspended its cross-chain bridge after an attacker created 10 million tokens that should not exist. The unauthorised mint was recorded on BNB Smart Chain at 12:31:38 UTC on Saturday, October 17, according to an incident statement from the Cysic Foundation published on Sunday and reported by crypto.news and FinanceFeeds.

Preliminary findings cite "unauthorized access to a database supporting the bridge", which the attacker combined with weaknesses in how the bridge processes messages to submit fraudulent mint instructions. At 13:47:52 UTC, about 76 minutes after the mint, Cysic blacklisted the receiving address on the token contract. About 2.8 million CYS, or 28% of the new tokens, were still there and can no longer be moved. Where the remaining 7.2 million or so went, and whether they were sold, has not been established.

The 10 million tokens equal 1% of CYS's 1 billion total supply. Cysic says its mainnet and other systems were not affected and that no existing balances were taken from customer wallets. It has not published a dollar loss or a full list of receiving addresses. An external security firm is tracing the tokens, and the foundation plans a follow-up report, with no date given for that or for reopening the bridge.