The cross-chain bridge has been hit again—this time it’s Cysic: 10 million tokens, $CYS , were conjured out of thin air.
Cysic’s official report says its cross-chain bridge was attacked on Saturday. The attacker exploited a vulnerability in message processing to mint 10 million CYS without authorization on BNB Smart Chain. The initial investigation points to a key issue: the attacker gained unauthorized access to the database supporting the bridge. In other words, the problem wasn’t with the chain itself, but with the data and access controls behind the bridge.
The timeline is also worth a look: the tokens were minted at 12:31:38 UTC, but the team didn’t add the receiving address to the token contract’s blacklist until 13:47:52—more than an hour later. At that point, the address still held around 2.8 million CYS, and transfers had been restricted. That response time isn’t slow by the standards of cross-chain security incidents, but it also shows how little time a project has once an attack window opens.
The team’s assessment is that the incident was limited to the bridge’s message-processing and minting functions. It did not affect the mainnet or other operational systems, and existing CYS in users’ wallets, as well as their other assets, were not stolen or transferred without authorization. Cysic also emphasized that the number of tokens minted cannot be equated directly with dollar losses. Transfers, exchanges, and actual losses related to the tokens are still under review. The team has brought in a security firm, and will publish a follow-up report once the investigation is complete.
One point worth noting: CYS is used to incentivize users, computing-power providers, governance participants, and contributors across the network. Unauthorized issuance can deal a very real blow to confidence in the incentive system, even if the ultimate losses are limited. The trust boundaries of a cross-chain bridge have never been something that code audits alone can secure.
#Cysic #跨链桥 #SecurityIncident
$BNB
Cysic’s official report says its cross-chain bridge was attacked on Saturday. The attacker exploited a vulnerability in message processing to mint 10 million CYS without authorization on BNB Smart Chain. The initial investigation points to a key issue: the attacker gained unauthorized access to the database supporting the bridge. In other words, the problem wasn’t with the chain itself, but with the data and access controls behind the bridge.
The timeline is also worth a look: the tokens were minted at 12:31:38 UTC, but the team didn’t add the receiving address to the token contract’s blacklist until 13:47:52—more than an hour later. At that point, the address still held around 2.8 million CYS, and transfers had been restricted. That response time isn’t slow by the standards of cross-chain security incidents, but it also shows how little time a project has once an attack window opens.
The team’s assessment is that the incident was limited to the bridge’s message-processing and minting functions. It did not affect the mainnet or other operational systems, and existing CYS in users’ wallets, as well as their other assets, were not stolen or transferred without authorization. Cysic also emphasized that the number of tokens minted cannot be equated directly with dollar losses. Transfers, exchanges, and actual losses related to the tokens are still under review. The team has brought in a security firm, and will publish a follow-up report once the investigation is complete.
One point worth noting: CYS is used to incentivize users, computing-power providers, governance participants, and contributors across the network. Unauthorized issuance can deal a very real blow to confidence in the incentive system, even if the ultimate losses are limited. The trust boundaries of a cross-chain bridge have never been something that code audits alone can secure.
#Cysic #跨链桥 #SecurityIncident
$BNB