Ten million tokens created out of thin air, 7.2 million of which were sold off straight away. On 17 October, an attacker exploited the Cysic bridge, the cross-chain bridge of this zero-knowledge proof infrastructure project, to mint 10 million CYS on BNB Smart Chain. According to on-chain data reported by Journal du Coin, about 306.6 ETH, worth $727,000 at Sunday's price, then made their way to Ethereum. Cysic has suspended its bridge and opened an investigation.

How the bridge flaw was exploited

The Cysic foundation's preliminary report describes a two-stage attack. The attacker first gained unauthorised access to a database used by the bridge's services. They reportedly then exploited a vulnerability in the processing logic to submit a fake minting message. The result: a transaction created 10 million CYS at 12:31 UTC on BNB Smart Chain.

The foundation places the incident in the bridge's message-processing and token-minting functions. It acknowledges, however, that the full attack path and the precise cause are still under investigation. The technical details of the vulnerability have not been disclosed at this stage, and it would be unwise to go further than what Cysic has published.

A rapid-fire sell-off

The attacker wasted no time. Five minutes after the minting, the receiving address began selling the CYS. According to The Block, cited by Journal du Coin, an initial series of eleven transactions swapped 5.65 million tokens for 588,315 USDT. Four further operations then converted 1.55 million CYS into about 220 BNB. The sales ended at 12:59 UTC.

Twelve of the fifteen transactions went through OKX's decentralised aggregator, which split the trades across several platforms, including PancakeSwap. In total, 7.2 million tokens were sold.

The foundation's response: a partial freeze

The foundation blacklisted the attacker's address on the CYS contract at 13:47 UTC, about 76 minutes after the fraudulent minting. This measure immobilises the 2.8 million tokens still held at the address. It does not, however, recover the assets obtained from the earlier sales.

Beyond that, Cysic's response comes down to a few points:

  • the bridge is suspended and will remain closed until the security review is complete;
  • a security firm, whose name has not been disclosed, is taking part in the investigation and in tracing the funds;
  • according to the foundation, no existing assets were stolen from users' wallets;
  • the mainnet is said to be operating normally: consensus, block production and transaction execution are reportedly unaffected.

These claims come from Cysic itself. No timetable for reopening the bridge has been given, nor has any compensation scheme.

About $727,000 gone to Ethereum

The attacker started moving the proceeds before even finishing the sales. They used SWFT, Mayan and deBridge to convert and transfer the USDT and BNB to Ethereum. Again according to The Block, the address received about 306.6 ETH on that network, then sent 306.52 ETH to a second wallet in five transfers.

This is where the freeze shows its limits: the blacklist only covers the CYS at the blocked address on BNB Smart Chain. It has no effect on the ether already moved to Ethereum. Tracing work, comparable to that carried out after other crypto hacks, then becomes the main lead.

Cysic also points out that the number of tokens minted does not, on its own, make it possible to calculate the final losses. The 10 million CYS created therefore do not translate mechanically into a damage figure, and the final number is not known.

Crypto bridges: why they remain exposed

The Cysic episode illustrates a structural weakness of cross-chain bridges. A bridge has to accept a message coming from one network in order to create or release tokens on another. If that message can be forged, as the foundation describes here, the bridge issues tokens that do not correspond to any real deposit. The present case also combines an off-chain component, a database, with the logic of the contract itself.

For DeFi security, the lesson can be summed up in a few words: the components that connect networks, whether in-house bridges or cross-chain deposit infrastructures, concentrate minting and transfer powers. A flaw at that point directly affects a token's supply. Journal du Coin does not provide statistics on the scale of bridge hacks in general, and we will not put any forward here.

It remains to be seen what Cysic's security review will establish about the exact cause, and when the bridge will reopen. Until then, the 2.8 million frozen CYS and the 306.52 ETH transferred to a second wallet are the two concrete elements to watch.

Sources

  • Journal du Coin: « 727 000 dollars envolés vers Ethereum : Le bridge de Cysic piraté »