GoKawiilCysic blacklists bridge exploit address, but 7.2M of 10M minted CYS tokens already moved
Cysic Foundation identified an unauthorized mint of 10 million CYS tokens on BNB Smart Chain at 12:31 UTC on Oct. 17, 2026, and blacklisted the recipient address 76 minutes later. By then only about 2.8 million tokens remained at that address, with the other 7.2 million already transferred elsewhere and still being tracked. The foundation says preliminary findings point to a compromised database and flaws in bridge processing logic, and the bridge remains offline with no restart date.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows that even a relatively fast blacklist response can't contain losses once tokens move across addresses, since freezes only apply where the tokens currently sit. Because the foundation has not confirmed the root cause or quantified the dollar loss, the full financial and reputational impact on Cysic remains uncertain until its promised follow-up report and third-party security review are complete.
- 10 million CYS tokens were minted without authorization on BNB Smart Chain before being partially blacklisted.
- Only 2.8 million tokens were frozen; 7.2 million had already left the flagged address and are being traced.
- Cysic's bridge is offline indefinitely while a third-party security firm investigates the suspected database and logic flaws.
Source: techreport.com — Krishi Chowdhary, 2026-10-20
Published there as: “76 minutes to blacklist: how Cysic’s response speed still left 7.2M tokens loose”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.