Cysic Attacker Sold 7.2M Minted Tokens and Bridged $727,000 to Ethereum Before the Blacklist

Published October 19, 2026, 1:50 AM PKT. Based on The Block's October 18, 2026 report citing on-chain records and NS3.AI tracing data (primary source), the Cysic Foundation's October 18, 2026 incident report on X (primary source), Particle's October 18, 2026 incident overview (secondary source), and MABOnChain's October 18, 2026 reporting on the original mint (secondary source). This is a follow-up to the earlier story.

The Cysic bridge attack now has a price tag, and the attacker set it before anyone could intervene. On-chain records reviewed by The Block show the attacker who exploited the bridge on Saturday, October 17, sold 7.2 million of the 10 million fraudulently minted CYS tokens within 28 minutes of the mint, then bridged the proceeds off BNB Chain and received 306.6 ETH, worth about $727,000, on Ethereum before Cysic blacklisted the recipient address. The remaining 2.8 million CYS sat frozen in the blacklisted address. MABOnChain reported the unauthorized mint on October 18, when Cysic said the dollar loss was still under review.

The 28-minute selloff: 7.2 million tokens in 26 transfers

The unauthorized mint happened at 12:31:38 UTC on Saturday, according to Cysic's incident report. BscScan records cited by The Block show the receiving address started moving the tokens five minutes later, selling 7.2 million CYS across 26 transfers in 15 transactions by 8:59 a.m. ET. At the final tally of about $727,000, that is more than $25,000 of proceeds per minute, a pace that shows the attacker had the exit planned before the mint went through.

The $727,000 move to Ethereum before the blacklist

After selling, the attacker bridged the proceeds off BNB Chain and received 306.6 ETH on Ethereum, according to the on-chain records. Cysic added the recipient address to the token contract's blacklist at 13:47:52 UTC, about 76 minutes after the mint. The roughly 2.8 million CYS still at the address was frozen, but the ether that had already crossed to Ethereum sat beyond the blacklist's reach. The Block attributed the on-chain tracing to NS3.AI.

The database breach behind the mint

The Cysic Foundation said in an incident report posted to X on Sunday that the attacker "gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message." The attacker did not break the token contract or the Cysic mainnet. The breach was in an off-chain database behind the bridge, and the bridge's own message processing was then abused to authorize the fraudulent mint.

The 10 million minted tokens equal 1% of CYS's 1 billion maximum supply, according to Particle's overview of the incident, which raises dilution risk for existing holders. Cysic, founded in 2022, builds specialized hardware and runs a Layer 1 network for generating zero-knowledge proofs. The company raised a $6 million seed round led by Polychain Capital in 2023. Its bridge moves CYS between the Cysic chain and networks including BNB Smart Chain and Base.

The bridge stays closed until the security review ends

Cysic has suspended the bridge and hired a security firm it did not name to investigate and trace the funds. The company said the incident was confined to the bridge's message processing and minting functions, did not affect the Cysic mainnet, and did not touch assets in user wallets. "Existing user assets were not stolen," the foundation said. The bridge will remain closed until the security review is complete, and Cysic plans to publish a follow-up report when the current investigation phase ends. The company has still not disclosed a verified dollar figure for its own losses, noting that the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms."

This article is news reporting and is not investment advice.

Sources

• The Block, October 18, 2026, primary source, on-chain records reviewed by The Block with tracing attributed to NS3.AI: attacker minted 10 million CYS on BNB Chain on Saturday; sold 7.2 million in 26 transfers across 15 transactions by 8:59 a.m. ET, about 28 minutes after the mint; bridged proceeds off BNB Chain and received 306.6 ETH, about $727,000, on Ethereum; remaining 2.8 million CYS frozen when Cysic blacklisted the receiving address
• Cysic Foundation incident report, posted to X on October 18, 2026, primary source: attacker gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message; bridge suspended; unnamed security firm hired to investigate and trace funds; incident confined to bridge message processing and minting functions; mainnet unaffected; existing user assets not stolen; token count alone does not represent the final dollar loss
• Particle, October 18, 2026, secondary source: mint equaled 1% of the 1 billion maximum CYS supply, raising dilution risk for holders; blacklisted wallet held about 2.8 million tokens roughly 76 minutes after the mint; about 7.2 million moved tokens traced to roughly 306.6 ETH, near $727,000; Cysic has not verified total proceeds or confirmed recoveries; bridge remains closed pending a forensic report
• MABOnChain, October 18, 2026, secondary source: original reporting on the unauthorized mint at 12:31:38 UTC, the blacklist at 13:47:52 UTC, and the dollar loss under review