Cysic Halts Cross-Chain Bridge After Attacker Mints 10 Million CYS on BNB Chain
Published October 18, 2026, 04:10 PM PKT. Based on Cysic's October 18, 2026 X incident report (primary source), Cointelegraph's October 18, 2026 report (secondary source), the project's tokenomics documentation (secondary source), and project guides published by MEXC and Bitget Academy (secondary sources).
Cysic has suspended its cross-chain bridge after an attacker exploited a processing flaw to mint 10 million of the network's CYS tokens on BNB Smart Chain. The company disclosed the incident in an X post on Sunday, October 18, 2026, saying preliminary findings point to unauthorized access to a database that supports the bridge.
Cysic is a decentralized network that provides hardware-accelerated computation for generating zero-knowledge proofs, with CYS as its native token, according to project guides published by MEXC and Bitget Academy. According to the project's tokenomics documentation, CYS coordinates incentives for users, compute providers, governance participants and contributors across the network.
The 12:31 UTC mint and the 76-minute response
The unauthorized mint happened at 12:31:38 UTC on Saturday, October 17, according to the incident report. Cysic added the recipient address to the token contract's blacklist at 13:47:52 UTC, about 76 minutes later, Cointelegraph reported. Roughly 2.8 million CYS remained at that address when the blacklist took effect, with transfers restricted.
The company was careful about what the numbers mean. Cysic said the size of the mint alone does not establish the incident's dollar impact, and that token transfers, swaps and actual losses remain under review.
What the attacker exploited
According to the company's preliminary findings, the attacker gained unauthorized access to a database supporting the bridge and used a flaw in the bridge's message processing to trigger the mint. The incident was limited to bridge message processing and minting, the company said, and did not affect the mainnet or other operational systems.
"The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets," Cysic said, meaning no holder lost tokens from their own balance in the attack.
What happens next
Cysic said it has hired a security firm and plans to publish a follow-up report once the current investigation phase is complete. The bridge remains suspended while the investigation continues.
This article is news reporting and is not investment advice.
Sources
- Cysic, October 18, 2026, primary source: X incident report; cross-chain bridge suspended after an attacker exploited a processing flaw to mint 10 million CYS on BNB Smart Chain on Saturday at 12:31:38 UTC; preliminary findings point to unauthorized access to a database supporting the bridge; recipient address added to the token contract's blacklist at 13:47:52 UTC; about 2.8 million CYS remained at that address with transfers restricted; incident limited to bridge message processing and minting, did not affect the mainnet or other operational systems; "The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets"; the mint size alone does not establish the incident's dollar impact; token transfers, swaps and actual losses under review; security firm hired; follow-up report planned after the current investigation phase
- Cointelegraph, October 18, 2026, secondary source: Cysic investigating an unauthorized issuance on BNB Smart Chain; bridge suspended after a processing-flaw exploit minted 10 million CYS on Saturday; mint at 12:31:38 UTC, recipient address blacklisted at 13:47:52 UTC; about 2.8 million CYS remained at the address with transfers restricted; CYS coordinates incentives for users, compute providers, governance participants and contributors per the project's tokenomics documentation; incident did not affect the mainnet or other operational systems; company hired a security firm and plans a follow-up report
- Cysic tokenomics documentation, secondary source: CYS coordinates incentives for users, compute providers, governance participants and contributors in the Cysic network
- MEXC and Bitget Academy project guides, secondary sources: Cysic is a decentralized network providing hardware-accelerated computation for generating zero-knowledge proofs, with CYS as its native token
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
Vitalik Buterin Builds 'Paranoid Mode' AI Agent Setup Using Tor, Cover Traffic and zkAPI
Ethereum co-founder Vitalik Buterin unveiled an experimental 'paranoid mode' for his pi AI agent harness that routes every conversation through a separate Tor circuit, masks requests with random cover traffic, pays for model access through the Ethereum-based zkAPI payment system, and rewrites every prompt locally before it reaches the provider. He says the setup is getting usable but still slow, and warns that Tor is a poor fit against a provider colluding with the network guard, calling instead for a specialized mixnet.
Bitget Names Russia, Belarus and Kazakhstan as Prohibited Jurisdictions, Bans 20 Sanctioned Platforms
Bitget's English Terms of Use, updated October 16, 2026, list Russia, Belarus and Kazakhstan among its prohibited jurisdictions, three days after the exchange said it would discontinue services for selected users in a one-off exercise. Separately, the exchange's Greater China arm said it will terminate accounts that transact with 20 sanctioned platforms, including BitPapa and NoOnecrypto, with a permanent no-re-registration rule for violators.
EU and 8 Nations Sign Warsaw Protocol to Seize Criminal Crypto Across Borders
The European Union and eight countries signed the Additional Protocol to the Council of Europe's Warsaw Convention in Strasbourg on October 14, 2026, writing crypto-assets explicitly into the international framework for seizing criminal proceeds. The protocol lets authorities confiscate virtual assets urgently without prior notice, gives financial intelligence units power to suspend suspect crypto transactions, requires Asset Recovery and Asset Management Offices in signatory states, and needs five ratifications to enter into force.
US Shutdown Freezes SEC Review of 100-Plus Crypto ETF Filings as Solana, XRP and Cardano Launches Stall
The US government shutdown has frozen the SEC's review of more than 100 crypto ETF filings, stalling expected October launches for Solana, XRP and Cardano products. Decision deadlines on three XRP ETFs and Grayscale's Cardano ETF passed silently this week, and Bloomberg's Eric Balchunas says the October 6-10 Solana window that issuers had high conviction about is now threatened. CoinShares' James Butterfill says up to $60 billion in ETP inflows is still possible this year once Washington reopens.
South Korea Summons Five Exchanges to October 20 Tax Hearing as 22% Crypto Tax Looms
South Korea's government will convene representatives of Upbit, Bithumb, Coinone, Digital X and GOPAX, plus the DAXA industry body, on October 20 to hear industry views on a planned 22% tax on virtual asset transfer and lending income starting January 1, 2027. The tax, already postponed three times since 2020, would apply a 20% other-income tax plus 2% local surcharge after a 2.5 million won basic exemption, while lawmakers have filed rival bills to push it to 2029 and 2030.
Treasury's GENIUS Proposal Forces US Exchanges Into Audit-or-Delist Choice on Foreign Stablecoins
The US Treasury's proposed GENIUS Act rules would let exchanges keep offering foreign-issued stablecoins only if they can defend the issuer's promise to comply with lawful US orders after reasonable due diligence, with reliance barred when the representation is false or the issuer cannot or will not comply. The Federal Register notice, published August 18, 2026 under docket TREAS-DO-2026-0496, takes comment through October 19, 2026 and sets an effective date of January 18, 2027, with a stricter permitted-issuer-only limit from July 18, 2028.
Circle Paid $819M of Its $1.4B First-Half Revenue to USDC Partners, Kept 7 Cents on the Dollar
Circle disclosed on October 16, 2026 that it generated roughly $1.4 billion in revenue in the first half of 2026 and paid about $819 million of it, 59 cents of every dollar, to USDC distribution partners and transaction costs. Chief commercial officer Kash Razzaghi said the company reinvested about $473 million in licenses, banking, liquidity, compliance and integrations, and kept 7 cents of net profit per dollar, in a direct rebuttal to new stablecoin entrants promising to share the majority of their economics.