Cysic: A Hacker Got Into the Bridge's Database, Printed 10M Tokens and Took $727,000

At 12:31 UTC on Saturday 17 October 2026, half past one in the afternoon in London, 10 million new CYS tokens appeared in a stranger's wallet on BNB Chain. Nobody had paid for them, and nothing had been locked up anywhere to back them. Five minutes later the wallet started selling.

CYS is the token of Cysic, a company that builds specialised computer hardware and runs its own blockchain network for producing zero-knowledge proofs, a kind of mathematical receipt that shows a calculation was done correctly without anyone having to redo it. The new tokens came out of Cysic's own bridge, the service that moves CYS between its home network and other blockchains. By the time Cysic froze the wallet, 76 minutes after the tokens appeared, the attacker had sold 7.2 million of them and moved about 306.6 ether, worth roughly $727,000, out to Ethereum, according to a transaction-by-transaction reconstruction by the news site The Block. The other 2.8 million CYS were stuck where they sat.

By the standards of 2026 the sum is small. Bitget lost $387.5 million in September. But the method is the one that keeps recurring this year: a bridge that can print tokens, and a back office that can be talked into telling it to. Cysic itself has not put a dollar figure on the loss. In its incident report it said the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms", and that transfers, swaps and realised losses were still being checked.

What a bridge is, and how this one broke

Every blockchain keeps its own ledger, rather like two stock exchanges with separate share registers that cannot read each other. A bridge is the currency exchange booth between them. A holder hands tokens in on one side, the booth locks or destroys them there, and it issues ("mints") the same number on the other side. The new tokens are only worth anything because the old ones are out of circulation. A booth that hands out pounds without taking in dollars is not changing money. It is printing it, and like a company issuing new shares that nobody paid for, every extra token dilutes everyone who already holds one.

The Cysic Foundation, the body that looks after the CYS token, published its incident report on X on Sunday 18 October. Its preliminary finding was that the attacker "gained unauthorized access to a database used by services supporting the bridge" and then used a flaw in how the bridge processed its messages to submit a fraudulent instruction to mint. In share-register terms, someone got into the registrar's back office and slipped a forged issuance order into the queue, and the registrar's software accepted it because it arrived from the place such orders normally come from.

Cysic has not said how the attacker reached the database, or exactly what the processing flaw was. It said the damage was limited to the bridge's message-processing and minting functions, and that its main network and other systems were unaffected. "The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets," the foundation said.

Seventy-six minutes

The Block rebuilt the attacker's morning from public blockchain records, and the Crypto Times reported the same sequence. The selling began at 12:36 UTC. In the first round, which ended at 12:41, the attacker sold 5.65 million CYS in 11 transactions for 588,315 USDT, the digital dollar issued by Tether, or about $0.10 a token. Twelve of the 15 sale transactions went through OKX's DEX aggregator, software that splits one large order across several trading venues, much as a broker's order-routing system spreads a big share sale across exchanges. Some of the trades were filled on PancakeSwap, the main trading venue on BNB Chain.

The money left at once. At 12:44 the attacker sent 100,000 USDT through Bridgers, a cross-chain service run by SWFT, and about a minute later 40.88 ether arrived on Ethereum. Between 12:46 and 12:53 the remaining 488,315 USDT went through another service, Mayan, in six transfers. A second round of selling followed from 12:57 to 12:59, when 1.55 million CYS fetched about 220 BNB, BNB Chain's own coin. At 13:05 the attacker sent 80 BNB through Mayan and, a minute later, 139 BNB through deBridge, a third service. The last ether payout landed at 13:06.

On Ethereum the receipts added up to about 306.6 ether: roughly 224.66 from Mayan, 41.05 from deBridge and 40.88 from Bridgers. At about $2,370 an ether, the CoinGecko price used in the reports, that is about $727,000. By 13:11 the attacker had forwarded 306.52 ether in five transfers to a second wallet. According to The Block, that second wallet had first received money about two hours before the mint, which suggests the exit was prepared before the break-in paid off.

©CMZ chart. Data: The Block, from on-chain data

Cysic blacklisted the receiving address at 13:47:52 UTC, 76 minutes after the mint and 48 minutes after the last sale. The freeze works because Cysic controls the CYS contract on BNB Chain, much as a registrar can freeze shares on its own register. It has no such power over ether on Ethereum, which is where the money had gone. The 2.8 million CYS left behind, about 28% of what was printed, can no longer be moved.

The 10 million extra tokens were about 6.2% of the roughly 160.8 million CYS in circulation, according to CoinMarketCap, and 1% of the 1 billion maximum supply. CYS traded at about $0.127 on the morning of 17 October, according to CoinGecko, and fell to $0.106 at 12:38 UTC, seven minutes after the mint, the lowest price it has recorded. On the morning of 19 October it was about $0.114, some 94% below its peak of $1.78 on 15 August.

The $727,000 did not come out of Cysic's customers' wallets. It came out of the trading pools on BNB Chain, which paid real digital dollars and BNB for tokens that had nothing behind them. Cysic has not said whether those 7.2 million tokens will be treated as valid, cancelled or replaced, or whether anyone who bought them will be compensated.

Bridges that print tokens

Five days earlier the same thing happened to Autheo, a project that calls itself an "Internet Operating System" and launched its network on 14 May 2026. On 12 October an attacker minted 19 million unbacked THEO tokens on Base, the blockchain run by the US exchange Coinbase, through Autheo's bridge, which is built on the bridging software Hyperlane. The security firm PeckShield reported that the tokens were sold for about 700.8 ether, about $1.76 million, and moved to Ethereum. THEO fell about 92% within a day, from about $0.08 to about $0.006.

Defimon Alerts, a monitoring service run by the security firm Decurity, said Autheo's token contract on Base relied on a Hyperlane setting called TrustedRelayerIsm. It lets a single relayer, one approved messenger, push instructions through without the signatures of independent checkers. In banking terms it is a payment system that accepts any order from one clerk, with no second signature. Hyperlane's own guide, Defimon noted, says new routes use that setting by default and that it should be removed before going live. Autheo had been audited by three firms, Halborn, CertiK and Avelar Labs, and has not confirmed the cause.

The figures are disputed. A researcher who posts as Vlad claimed about 119 million THEO were minted, and an X user called Zynex said an address linked to the attacker had sent him 93.5 million THEO, which he offered to return. Autheo has confirmed neither. The exchange MEXC suspended THEO deposits and withdrawals on 13 October at Autheo's request, and on 17 October Autheo again told holders not to buy, sell or bridge THEO.

The pattern is not new this year. In September an attacker who got into SingularityNET's cloud systems used its bridge to print about 2.3 billion tokens across five coins and cashed out about $2.29 million. In April an attacker printed 1 billion fake DOT through Hyperbridge. In each case the blockchain did what it was told. The weak point was whatever sat off the chain and was trusted to do the telling: a signing key, a single relayer, a database.