Cysic Bridge Attacker Moved 306.6 Ether (ETH) After Unauthorized Mint

An attacker moved proceeds from an unauthorized Cysic (CYS) mint into about 306.6 Ether (ETH), worth roughly $727,000, after selling most of the tokens created through the project's cross-chain bridge.

The attacker minted 10 million CYS on BNB Chain at 8:31 a.m. ET (12:31 UTC) on Oct. 17. Sales began about five minutes later. By about 8:59 a.m. ET (12:59 UTC), about 7.2 million CYS had been sold in 15 transactions.

The first 11 sales accounted for 5.65 million CYS. Four later transactions sold another 1.55 million CYS. The proceeds passed through SWFT, Mayan and deBridge before an Ethereum wallet received about 306.6 ETH. The roughly $727,000 value of that ETH is not a final estimate of the incident's losses.

Cysic added the recipient address to the CYS contract's blacklist at 9:47 a.m. ET (13:47 UTC). The blacklist action came roughly 76 minutes after the mint, when about 2.8 million of the unauthorized tokens remained in the address.

The 10 million newly minted CYS equaled 1% of the token's stated 1 billion-token supply. Cysic develops computing infrastructure for zero-knowledge proofs, and its bridge moves CYS between its mainnet and other networks.

Preliminary findings point to unauthorized access to a database supporting the bridge and a flaw in how the bridge processed messages. A false mint instruction created CYS on BNB Chain without a corresponding transfer of assets from another network.

Cysic's mainnet was not affected, and the incident did not directly take assets already held in user wallets. The bridge remains suspended while the attack is investigated.