Cysic's blacklist came 76 minutes after the mint, once 7.2 million CYS were dumped

On October 17, a forged mint message forced 10 million unauthorized CYS tokens out of Cysic’s cross-chain bridge.

The attacker’s wallet dumped 7.2 million of them and moved about $727,000 into Ethereum before the project locked it up.

Two selling rounds fetched 588,315 USDT and 220 BNB

On-chain data reveals a fraudulent mint hit BNB Smart Chain at 12:31 UTC on October 17. But the foundation’s incident report says that Cysic did not blacklist the receiving wallet in the CYS contract until 13:47 UTC.

The gap was 76 minutes long. The address had stopped sending tokens 48 minutes before the freeze and had moved its proceeds from BNB Chain by the time the freeze struck.

Blacklist took the remains: ~2.8 million CYS that can no longer be transferred. About 160.8 million CYS circulate.

As per BscScan records, the dumping was in two rounds. The first 5.65 million CYS sold for 588,315 USDT in five minutes from 12:36 UTC, at about 10 cents each.

A second, smaller round ran from 12:57 to 12:59 UTC. It garnered about 220 BNB for the last 1.55 million tokens.

Twelve of the 15 sales were completed using OKX’s DEX aggregator. The orders were divided between several venues, including PancakeSwap.

Mayan, deBridge and SWFT carried 306.6 ETH to Ethereum

SWFT’s Bridgers service took the first 100,000 USDT at 12:44 UTC. About a minute later, 40.88 ETH landed on Ethereum.

Another 488,315 USDT was moved to the cross-chain protocol Mayan in six transfers by 12:53 UTC.

After the second sell-off, BNB followed. Mayan carried 80 of those BNB at 13:05 UTC, and deBridge handled 139 more at 13:06.

According to Etherscan data, Mayan paid out around 224.66 ETH and deBridge 41.05 ETH, with the last arriving at 13:06 UTC. The total was ~306.6 ETH or ~$727,000 at the price of ETH on October 18 of ~$2,372.

By 13:11 UTC, a second wallet had received 306.52 ETH through five transfers. Its first deposit was made about two hours before the mint.

The CYS contract’s blacklist does not reach ETH.

The attacker “gained unauthorized access to a database used by services supporting the bridge and exploited a vulnerability in the relevant processing logic to submit a fraudulent mint message,” the Cysic Foundation said in an X incident report on October 18.

The foundation said the incident was isolated to bridge message handling and minting and did not affect consensus, block production and EVM execution on the Cysic mainnet. “Existing user assets were not stolen,” it said.

Cysic dates to 2022 and generates zero-knowledge proofs on dedicated hardware and its own Layer 1 chain. Polychain Capital led its $6 million seed round in 2023.

The foundation said that the final dollar figure is not determined by the 10 million minted tokens alone.

Cross-chain transfers through the bridge stay offline until Cysic finishes a security review. A second report is due on verified losses and fund tracing.

Cryptopolitan reported that Symbiosis suspended its Bitcoin bridge in September when an attacker minted an immense synthetic balance, but walked away with about $336,000.

In June, a validation flaw permitted an attacker to mint around 5 billion unauthorized SYS. Syscoin froze its bridge.

The smartest crypto minds already read our newsletter. Want in? Join them.