The incident began at 12: 31: 38 UTC on Oct. 17, when an attacker used the bridge to mint 10 million CYS tokens on BNB Smart Chain without authorization. Cysic’s preliminary account pointed to unauthorized access to a database supporting bridge services and a flaw in the processing logic that accepted a fraudulent mint message.
Before the blacklist took effect, the attacker moved all 7. 2 million CYS that left the receiving wallet across 26 transfers in 15 transactions over roughly 23 minutes. The tokens were exchanged for about 588,315 USDT and 220 BNB, then routed through SWFT’s BridgersSwap, Mayan and deBridge. 6 ETH on Ethereum, valued at roughly $727,000 at the price used in the transaction reconstruction. The blacklist applied to CYS on BNB Chain and could not stop the ether that had already crossed to Ethereum.
On Oct. 22, an address controlled by Cysic sent the exploiter an on-chain message offering to let the attacker keep about 30. The subsequent 300-ETH Tornado Cash deposits were made in three 100-ETH transactions between 06: 27: 59 and 06: 29: 59 UTC on Oct. 23, an action consistent with movement away from the proposed recovery arrangement, although no direct response was attached to the transfers.
Cysic said the exploit was limited to bridge message processing and minting, with no unauthorized transfer of existing assets in user wallets or reported effect on its mainnet. The project hired an unnamed security firm, kept the bridge offline pending a security review and said it would publish a follow-up report on verified losses and fund tracing after the investigation phase. The attacker has not been identified, the bridge has no announced restart date, and the foundation has not established a final dollar loss beyond the on-chain proceeds reconstructed so far.