On October 17 at 14:31 Warsaw time, an attacker minted 10 million CYS on BNB Smart Chain through Cysic's cross-chain bridge. According to the Cysic Foundation's incident report, the attacker gained unauthorized access to a database used by services supporting the bridge and exploited a flaw in the processing logic to submit a fraudulent mint message. The full attack path and root cause are still under investigation.
The attacker moved fast. Within five minutes the receiving address began selling, mostly through OKX's DEX aggregator, and about 7.2 million CYS were sold for USDT and BNB. The proceeds were bridged to Ethereum through Mayan, deBridge and SWFT, arriving as roughly 306.6 ETH, about $727K. Cysic blacklisted the address at 15:47, 76 minutes after the mint, freezing the remaining 2.8 million CYS.
Cysic has suspended the bridge pending a security review and says its mainnet and existing user assets were not affected. It has not published a dollar loss and promises a follow-up report. Security firm ExVul says it has joined the investigation and on-chain tracing.
The lesson
A bridge is only as strong as the off-chain systems that feed it. Cysic's preliminary account describes database access plus a trusting message handler, not a smart contract bug. Mint paths should verify every message against on-chain proof of a deposit, enforce caps and rate limits, and alert on any unbacked supply increase. A 76-minute response is fast by industry standards, yet most of the value was already on Ethereum within about 35 minutes.