Cysic Freezes About 2.8 Million Tokens, but That Doesn’t Mean the Transferred Assets Have Been Recovered
My assessment: This freeze restricts transfers of the remaining CYS; it should not be treated as a recovery of funds. Affected users should focus first on the bridge fix and the conditions for reopening it. Don’t assume cross-chain risk has been eliminated just because the “mainnet was unaffected.”
On October 18, the Cysic Foundation disclosed that on the 17th, someone exploited an issue in the cross-chain bridge’s processing logic to mint 10 million CYS without authorization on BNB Smart Chain. The team paused the bridge and added the receiving address to the CYS contract’s blacklist, restricting transfers of the roughly 2.8 million CYS still at that address.
However, some of the tokens had already been exchanged for other assets before the response. On the 18th, The Block reported, based on on-chain records, that the attacker’s address first sold 7.2 million CYS, then transferred the proceeds to Ethereum via a cross-chain service, receiving about 306.6 ETH. This figure reflects the transfers tracked in the report; it is not an official estimate of the final loss.
The distinction is that the CYS contract on BNB Chain can restrict tokens issued by that contract, but this blacklist cannot freeze ETH on Ethereum. Pausing the bridge blocks further risk; restricting the remaining tokens controls some of the assets; tracking and recovering assets that have already been exchanged are separate matters.
The Foundation said the mainnet was unaffected and that users’ existing wallet assets were not stolen or transferred in this incident. The full root cause, flow of funds, and actual losses are still under investigation. This is the project’s current disclosure; it does not mean all economic impact has been ruled out, nor can the final loss be determined simply by multiplying the number of newly minted tokens by the token price.
Over the next 48 hours, I’ll check for the official follow-up report, updates on the remaining tokens, and plans for reopening the bridge. I’ll lower my risk assessment for the bridge only once the root cause, fix verification, and reopening conditions are clear. If there is another anomalous mint or the impact widens, I’ll raise the risk assessment. Until then, I won’t treat “frozen” as grounds to resume cross-chain activity.
#Cysic #跨链桥 #OnchainSecurity
My assessment: This freeze restricts transfers of the remaining CYS; it should not be treated as a recovery of funds. Affected users should focus first on the bridge fix and the conditions for reopening it. Don’t assume cross-chain risk has been eliminated just because the “mainnet was unaffected.”
On October 18, the Cysic Foundation disclosed that on the 17th, someone exploited an issue in the cross-chain bridge’s processing logic to mint 10 million CYS without authorization on BNB Smart Chain. The team paused the bridge and added the receiving address to the CYS contract’s blacklist, restricting transfers of the roughly 2.8 million CYS still at that address.
However, some of the tokens had already been exchanged for other assets before the response. On the 18th, The Block reported, based on on-chain records, that the attacker’s address first sold 7.2 million CYS, then transferred the proceeds to Ethereum via a cross-chain service, receiving about 306.6 ETH. This figure reflects the transfers tracked in the report; it is not an official estimate of the final loss.
The distinction is that the CYS contract on BNB Chain can restrict tokens issued by that contract, but this blacklist cannot freeze ETH on Ethereum. Pausing the bridge blocks further risk; restricting the remaining tokens controls some of the assets; tracking and recovering assets that have already been exchanged are separate matters.
The Foundation said the mainnet was unaffected and that users’ existing wallet assets were not stolen or transferred in this incident. The full root cause, flow of funds, and actual losses are still under investigation. This is the project’s current disclosure; it does not mean all economic impact has been ruled out, nor can the final loss be determined simply by multiplying the number of newly minted tokens by the token price.
Over the next 48 hours, I’ll check for the official follow-up report, updates on the remaining tokens, and plans for reopening the bridge. I’ll lower my risk assessment for the bridge only once the root cause, fix verification, and reopening conditions are clear. If there is another anomalous mint or the impact widens, I’ll raise the risk assessment. Until then, I won’t treat “frozen” as grounds to resume cross-chain activity.
#Cysic #跨链桥 #OnchainSecurity