Cysic suspends bridge after attacker mints tokens and moves $727,000 to Ethereum
An attacker minted 10 million CYS tokens on BNB Chain by exploiting Cysic's cross-chain bridge on Saturday, the project confirmed. The attacker managed to sell 7.2 million of the unauthorized tokens and bridge about $727,000 in proceeds to Ethereum before the project blacklisted the attacker's receiving address, freezing the remaining 2.8 million tokens, according to onchain records reviewed by The Block.Cysic, founded in 2022, builds specialized hardware and runs a Layer 1 network for generating zero-knowledge proofs. The company raised a $6 million seed round led by Polychain Capital in 2023. Cysic's bridge moves tokens, including CYS, between the Cysic chain and other networks such as BNB Smart Chain and Base.The Cysic Foundation said in an incident report posted to X on Sunday that the attacker "gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message." Cysic said it suspended the bridge and tasked a security firm, which it did not name, with investigating and tracing the funds.The foundation said the incident was confined to the bridge's message-processing and minting functions and did not affect the Cysic mainnet. "Existing user assets were not stolen," the foundation said. Cysic has not disclosed a dollar figure for its losses, noting that the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms."Attacker sold tokens before being blacklistedThe attacker's unauthorized mint took place at 8:31 a.m. ET on Saturday, per onchain data. BscScan records show the receiving address began moving CYS five minutes later, sending out 7.2 million tokens in 26 transfers across 15 transactions by 8:59 a.m. ET.The address sold the tokens in two rounds. Between 8:36 and 8:41 a.m. ET, it sold 5.65 million CYS in 11 transactions for a combined 588,315 USDT, or about 10 cents per token. Between 8:57 and 8:59 a.m. ET, it sold the remaining 1.55 million CYS in four transactions for about 220 BNB.Twelve of the 15 transactions were routed through OKX’s DEX aggregator, which split the orders across exchanges including PancakeSwap.Cysic blacklisted the address in the CYS token contract at 9:47 a.m. ET, according to its report and onchain records, meaning the attacker's remaining 2.8 million CYS holdings can no longer be transferred. The blacklist landed 76 minutes after the initial exploit transaction, and 48 minutes after the attacker's address stopped sending out tokens.Funds moved to EthereumAt 8:44 a.m. ET, the address sent 100,000 USDT to a BridgersSwap contract operated by cross-chain swap service SWFT, and about a minute later received 40.88 ETH on Ethereum from a SWFT contract. It sent the remaining 488,315 USDT to cross-chain protocol Mayan in six transfers between 8:46 and 8:53 a.m. ET.After the second round of sales, the address bridged its BNB as well, sending 80 BNB through Mayan at 9:05 a.m. ET and 139 BNB through deBridge a minute later.On Ethereum, the address received seven payouts from Mayan totaling about 224.66 ETH and a 41.05 ETH payout from deBridge, with the last arriving at 9:06 a.m. ET, Etherscan records show. Including the SWFT transfer, the address received about 306.6 ETH, worth roughly $727,000 at Sunday's ETH price of about $2,372.The address then sent 306.52 ETH in five transfers to a second wallet by 9:11 a.m. ET. That wallet, which first received funds about two hours before the mint, held about 309.5 ETH as of Sunday morning. Cysic's blacklist applies only to CYS on BNB Chain and does not affect the ether.Cysic said the bridge will remain closed until a security review is complete, and that it will publish a follow-up report on verified losses and its efforts to trace the funds.The Block has reached out to Cysic and its PR representatives for comment.