Cysic has suspended its cross-chain bridge after an attacker created 10 million unauthorized CYS tokens on BNB Chain. Part of the illicit supply was converted and moved toward Ethereum, with on-chain analysis tracing the sale of about 7.2 million CYS and the receipt of 306.6 ETH — roughly $727,000 at the time.
Cysic blocked an address as part of its response. The intervention came after a substantial portion of the unauthorized issuance had already been traded.
How the tokens moved
The attacker didn't sit on the newly minted tokens. They exchanged them through decentralized venues and routed the proceeds across chains, splitting funds between swaps and bridges as they went. That routing matters for recovery: once proceeds are spread across multiple destinations, clawing them back becomes considerably harder than freezing a single address.
The trace shows the sale of about 7.2 million CYS and the receipt of 306.6 ETH. The remaining unauthorized supply was not accounted for in the facts available at publication.
A failure in cross-chain accounting
The incident points to a failure in cross-chain accounting and verification. A token minted on one network is supposed to correspond to an authorized event somewhere else — a lock, a burn, a verified message. Here, 10 million tokens entered circulation without that authorization.
Cysic will need to account for the failure in its message-verification process and explain corrective action before normal operations can safely resume. That's the crux of it: the bridge's security is the question, not the wider network's functioning. Users should keep the two separate rather than assuming every component suffered the same compromise.
New tokens entering the market can pressure CYS's price and expose liquidity providers to losses. Honest holders are left with a more uncomfortable question: which balances are valid? The facts don't resolve that yet, and until Cysic publishes a full accounting, the distinction between authorized and unauthorized supply rests on the project's own disclosures.
The timing isn't great for a bridge already asking users to trust its verification layer. But the immediate damage is contained to the bridge and the venues where the tokens were swapped, not the underlying chains.
What Cysic owes users next
The project hasn't said when the bridge will reopen, and the facts don't set a deadline. What's clear is the order of operations: Cysic has to explain how 10 million unauthorized tokens cleared its message-verification process, detail the fix, and account for the roughly 7.2 million CYS that were already sold before its address block landed. Until that explanation is public, normal operations shouldn't resume — and holders have no independent way to tell valid balances from the rest.
