Cysic crypto bridge halted after unauthorized mint of 10M CYS

Holders could not withdraw or deposit CYS on KuCoin once the exchange froze the service for unspecified maintenance, leaving no timeline for when trading resumes. Anyone who bought the 7.2 million forged tokens the attacker dumped before the blacklist landed is holding exposure built on a supply that never should have existed, while the 2.8 million CYS still frozen at the recipient address sits in limbo pending Cysic's next move.

A project that can blacklist an address and lock up tokens after the fact is not running a permissionless bridge in the sense marketed to users; it is running infrastructure with an admin key, which is reassuring when it stops a theft and uncomfortable when it reveals how much central control was there all along. The 76 minutes between the forged mint and the blacklist is also the real lesson: that gap, not the bridge's design on paper, is what let $727,000 reach Ethereum through Mayan, deBridge and SWFT's Bridgers.

Cysic's own postmortem, still pending beyond its initial statement that the mainnet was untouched, will decide whether this was a signature-verification flaw unique to its relayer or a pattern other bridges share. KuCoin's deposit reopening, with no date yet given, is the practical marker traders are watching, alongside whether Cysic moves to compensate holders of the diluted supply or simply leaves the 2.8 million frozen CYS unresolved.