Cysic — a crypto project coordinating incentives for users, compute providers, governance participants, and contributors — suspended its cross-chain bridge after an attacker exploited a message-processing flaw to mint 10 million CYS tokens illegally on BNB Smart Chain on Saturday, as reported by Cointelegraph and Crypto Briefing.
The timeline, per Cysic’s official incident report on X: the unauthorized mint occurred at 12:31:38 UTC. Seventeen minutes later — at 13:47:52 UTC — the team blacklisted the recipient address on the token contract. About 2.8 million CYS remained at that address with transfers restricted. Preliminary findings point to unauthorized access to a database supporting the bridge.
Cysic stressed the incident was limited to the bridge’s message processing and minting — the mainnet and other operational systems were unaffected — and added that the mint size alone does not establish the dollar impact, since the tokens may never have been cashed out.
The incident is the latest episode in DeFi’s repeating pattern: cross-chain bridges hold the largest locked value and present the most complex attack surface — recall the Ronin and Wormhole hacks. The lesson for Indonesian users holding assets in crypto projects: favor projects with transparent, fast incident response (in Cysic’s case, the address was locked in under 20 minutes), and note that funds in “bridges” carry extra technical risk beyond price risk.