Another Bridge Hack: 10 Million Tokens Minted Without a Single Deposit

The breach let the attacker mint 10 million CYS with no deposit behind them, then convert 7.2 million of that into 306.6 ETH, worth about $727,000, before Cysic could react. Holders and the team now face a suspended bridge, a blacklisted receiving address holding roughly 2.8 million frozen CYS, and no current path to move CYS across chains until the flawed mint-message handling is fixed. Mainnet users and existing wallet balances were untouched, but the token's circulating supply integrity is now in question.

A preliminary finding of a breached database points to a basic operational failure, not a cryptographic one: the bridge trusted messages it should have independently verified. That a team can unilaterally blacklist an address and freeze funds also shows how much centralised control still sits behind bridges marketed as trust-minimised infrastructure. The real tension is between the promise of permissionless cross-chain transfer and the reality that a single compromised database can create tokens from nothing. (per crypto-news-flash.com)

Cysic has not yet published a final loss figure or a full post-mortem on the database breach behind the unauthorised mint. Whether the frozen 2.8 million CYS at the blacklisted address can be clawed back, and whether the bridge reopens with new message-verification safeguards, will determine how much damage the incident leaves behind. The $727,000 already converted to ETH on Ethereum remains the clearest unresolved loss on the table.