Cysic Suspends Its Bridge After a 10M CYS Mint With No Deposit

Ten million CYS appeared on BNB Smart Chain on Saturday with nothing deposited to back them. The mint landed at 12:31 UTC, and within half an hour most of those tokens had been swapped away. Cysic, which builds hardware for zero-knowledge proofs, the cryptography that lets one system check another's work without repeating it, suspended its bridge and blacklisted the receiving address 76 minutes later. By then about 306.6 ether had reached Ethereum. The foundation has published no loss figure of its own.

Seventy-six minutes

The sequence is visible on chain and the two fullest accounts of it agree. Between 12:36 and 12:41 UTC, 5.65 million CYS went for 588,315 USDT. Another 1.55 million went for about 220 BNB between 12:57 and 12:59. That left 2.8 million tokens sitting at the address when Cysic blacklisted it at 13:47 UTC. The proceeds crossed to Ethereum through three separate routes, Mayan, deBridge and SWFT's BridgersSwap, and the last payout landed at 13:06. The blacklist covers CYS on BNB Chain. It does not reach the ether.

Crypto Times, which published its reconstruction on Sunday evening, counts 15 swap transactions and traces the ether onward to a second wallet by 13:11 UTC. The Block's account, filed earlier that afternoon, carries neither detail. Both describe the 7.2 million tokens as sold, though Crypto Times also calls them sent out, in the same piece, a few paragraphs apart. The swap figures themselves are identical in both.

A database, then a mint message

Cysic's preliminary account puts the entry point outside the bridge contract. The attacker "gained unauthorized access to a database used by services supporting the bridge," the foundation said in an incident report posted on Sunday, and then used a flaw in the bridge's message-processing logic to submit a mint instruction that no deposit matched. Existing user assets were not stolen, in its account, and the mainnet was untouched. The full attack path is still under investigation. An outside security firm has been engaged to trace the money, and Cysic has not said which one.

The dollar figure nobody published

Every $727,000 in circulation on Sunday was arithmetic, not disclosure. Three outlets reached it the same way, by pricing roughly 306.6 ether at the Sunday market. The Block used about $2,372 an ether; Crypto Times used about $2,370 and credited CoinGecko. Two dollars apart, and neither names its mark. The foundation addressed the point itself.

The minted token count "does not, by itself, represent the final loss in U.S. dollar terms," the incident report said.

A smaller gap sits inside the on-chain tally. Receipts come to about 306.6 ether across the three bridges, while the onward transfer to the second wallet is given as 306.52. Eight hundredths of an ether goes unexplained in every published account, and it may be nothing more than rounding. One outlet put CYS near $0.1144 late on Sunday, down under 2% over 24 hours, with an all-time low of $0.1076 printed on the day of the mint. That reading appears in a single account. The swaps themselves cleared around ten cents a token.

The bridge stays shut

Cysic says the bridge reopens once a security review of its workflow finishes, and has given no date. A report on verified losses is promised for the end of the current investigation phase. Until it lands, the only loss figure anyone outside the company can check is the one on Ethereum. The shape is familiar: in June, Secret Network's Axelar connection took a $4.67 million infinite mint, and six days before Cysic's, unbacked THEO appeared on Base and that token fell about 92%. CYS did not move anything like that far. What sets this one apart is where the attacker got in. A contract bug is fixed in the contract, while a credential lifted from a supporting database raises a question about everything else that database can reach, and Cysic has not said what that is.