On Saturday, October 17, 2026, the Cysic cross-chain bridge suffered a security incident that let an attacker mint 10 million CYS tokens out of thin air on BNB Chain. The bridge is now suspended, a security firm has been hired, and the crypto community is asking the same question it asks every few months: why do bridges keep breaking?

The 76-minute timeline

According to Cysic’s incident announcement, the attacker gained unauthorized access to a database supporting the bridge service and exploited a vulnerability in its message-processing logic. At 12:31:38 UTC, 10 million CYS were minted to an attacker-controlled address on BNB Chain.

Cysic’s team detected the anomaly and, at 13:47:52 UTC — just 76 minutes later — blacklisted the recipient address directly in the CYS token contract. Roughly 2.8 million CYS were still sitting at that address and are now frozen. But on-chain records show that some of the minted tokens were sold before the blacklist took effect, meaning part of the damage was already done.

What was (and was not) affected

• ▸Affected: the bridge’s message processing and token minting functions only.
• ▸Not affected: the Cysic mainnet, other operational systems, and — critically — no existing user assets were stolen from wallets.
• ▸Unknown: the final dollar impact. Cysic stressed that “the number of tokens minted does not establish the final dollar loss,” with transfers, swaps, and actual losses still under review.

Why bridges keep breaking

Cross-chain bridges are among the most complex pieces of software in crypto. They must lock tokens on one chain, verify the lock, and mint representations on another — all while trusting off-chain relayers, databases, and message-passing layers. Every one of those components is an attack surface.

The Cysic incident is notable because the entry point was not a smart-contract bug in the usual sense, but unauthorized database access combined with a processing-logic flaw. It is a reminder that bridge security is not just about audited contracts — the off-chain infrastructure matters just as much, and it is often less scrutinized.

This is not an isolated event. 2026 has already seen multiple bridge incidents, including the $3.8M NEAR Intents drain in early October (fully recovered after a public 48-hour ultimatum) and a $100M BNB Chain bridge exploit earlier in the month. The pattern is consistent: bridges concentrate risk, and attackers know it.

“The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets. — Cysic Foundation”

What happens next

Cysic has engaged a professional security firm to investigate the attack path and trace fund flows, and says it will publish a follow-up report. The bridge will only reopen after a full security review. For users, the practical takeaway is familiar but worth repeating: keep only what you need in bridge contracts, and treat every cross-chain transfer as carrying smart-contract plus infrastructure risk.