Cysic Bridge Exploit: 10 Million CYS Minted on BNB Chain — What CYS Holders Should Check Now

What happened, in Cysic's own words

The source is the "Cysic Incident Report" posted by the Cysic Foundation on X on October 18, 2026. It sets out the timeline and the scope:

Cysic says preliminary findings point to unauthorized access to a database used by services that support the bridge. The attacker then exploited a flaw in the processing logic to submit a fraudulent mint message. In other words, the bridge was tricked into creating new tokens on BNB Smart Chain without the matching tokens being locked elsewhere. The full attack path and root cause are still under investigation.

The foundation draws three lines around the damage:

• The mainnet was not affected. Consensus, block production, transaction confirmation and EVM execution on the Cysic network are outside the incident's scope, according to the report.
• Existing balances were not stolen. Cysic says the incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets.
• The bridge stays closed. Cross-chain transfers through it are unavailable, and Cysic will reopen it only after a full security review, with the arrangements announced on official channels.

How big is 10 million CYS?

Cysic's tokenomics page puts total supply at 1,000,000,000 CYS, so the illicit mint equals 1% of total supply. Against the market, the comparison that matters is circulating supply. CoinGecko listed 160.8 million CYS in circulation at 12:48 UTC on October 18, which makes the mint roughly 6.2% of the circulating float.

At CoinGecko's price at that time, $0.1164, 10 million CYS would be worth about $1.16 million. That is our arithmetic on a snapshot price, not a loss figure. Cysic stresses that the number minted "does not, by itself, represent the final loss in U.S. dollar terms", and that later transfers and swaps of the tokens are still under review.

What we can say from the report is that about 2.8 million CYS remained at the attacker's address when it was frozen. The difference, roughly 7.2 million CYS, had already left that address before the blacklist took effect. Where those tokens went, and how many were sold, is exactly what the follow-up report is meant to establish.

The price picture on CoinGecko at the same snapshot: CYS traded between $0.109 and $0.132 over the prior 24 hours, was up about 2.6% on the day and down about 22.5% over seven days. A seven-day drop that large covers more than this incident, so do not read the whole move as a reaction to the exploit.

What this means for you if you hold CYS

If your CYS sits in your own wallet, Cysic's position is that existing balances were not touched. You do not need to move anything to stay safe from this incident, and moving tokens during an incident adds risk of its own.

Do not use the bridge. It is closed. Any site offering to "bridge", "migrate", "claim compensation" or "verify" your CYS right now is a red flag. Cysic says updates will come only through its official channels.

Check deposits before you send CYS to an exchange. KuCoin has suspended CYS deposits and said it will not publish a separate notice when the service returns. CoinGecko lists CYS on several other centralized venues, including Bitget, Gate, MEXC, Upbit and Bithumb. We found no deposit notice from them in the official announcement feeds we track at the time of writing, which is not the same as confirming deposits are open. Look at the deposit page of the exact network you plan to use before you send anything, and make sure the network matches: CoinGecko lists CYS contracts on BNB Smart Chain and Base.

If you trade CYS on an exchange, expect wider spreads and sudden moves while the loss figure is unknown. Keep position size small, avoid leverage on a token that is in the middle of an investigation, and set the price you are willing to accept before you click.

Why bridges keep getting hit

A bridge is a promise that tokens minted on one chain are backed by tokens locked on another. If an attacker can forge the message that says "tokens were locked", the bridge mints new tokens with nothing behind them. Cysic's case fits that pattern: the attacker did not break the CYS contract or the Cysic network, they got into the off-chain machinery that feeds messages to the bridge.

Two things limited the damage here. The CYS contract on BNB Smart Chain has a blacklist function, which let Cysic freeze the remaining tokens at that address. And Cysic shut the bridge quickly. Both are centralized controls; they helped this time, and they are also worth knowing about if you hold the token, because the issuer can restrict addresses.

How to act on this

Treat the next few days as a waiting period. If you want to keep trading through the news, do it on a venue where CYS deposits are confirmed open and fees are low; Bitget, where CoinGecko lists a CYS market, gives a fee rebate when you register with code nexu888, and our Bitget exchange profile shows its current fees. For the wider market picture while a single-token story plays out, our 24-hour liquidations board shows whether leverage is being flushed across the market, and the latest exchange news tracks deposit suspensions and restorations as venues post them.

What we could not verify

• The final dollar loss and how many of the roughly 7.2 million moved CYS were sold. Cysic says this is under review.
• Whether exchanges other than KuCoin changed CYS deposit or withdrawal status.
• When the bridge will reopen. Cysic gives no date.

Quick answers

Were CYS holders' wallets drained? No, according to Cysic: existing CYS and other assets in user wallets were not stolen or moved without authorization.

Is the Cysic mainnet safe? Cysic says the mainnet was not affected; the incident was confined to the bridge's message processing and minting.

Can I deposit CYS on KuCoin? Not now. KuCoin suspended CYS deposits on October 18 and said it will not post a separate notice when they resume, so check the deposit page.

How many CYS were frozen? About 2.8 million CYS remained at the attacker's address and are restricted by the blacklist.

When will the bridge reopen? Only after Cysic completes its security review; no date has been given.