Cysic has closed its service for moving tokens between blockchains after an attacker created 10 million CYS tokens without permission. The attack happened on October 17 on BNB Smart Chain; the project published its incident report the following day. [1]
Most of those tokens had already been sold before the project froze the receiving address, according to The Block’s transaction analysis. For CYS holders, the problem now extends beyond stopping another unauthorized issue: sale proceeds have already left that wallet. [2]
View the token amounts and timing
| Event or amount | Reported result |
|---|---|
| Unauthorized creation | 10 million CYS at 12:31:38 UTC, Cysic report. |
| Sold | 7.2 million CYS, 72% of 10 million, The Block analysis. |
| Remaining and restricted | About 2.8 million CYS, 28% of 10 million, Cysic report. |
| Address blacklisted | 13:47:52 UTC, Cysic report; 76 minutes 14 seconds after mint. |
Percentages are SpecCoins arithmetic using rounded reported token amounts. They are not recovery rates, dollar losses or shares of current circulating supply. The project has not established final losses.
What the freeze could still stop
Cysic’s report puts the unauthorized creation at 12:31 UTC and the address blacklist at 13:47 UTC, about 76 minutes later. It says roughly 2.8 million CYS remained at that address when transfers were restricted. [1]
The Block reports that the attacker sold 7.2 million CYS and moved proceeds to Ethereum, receiving about 306.6 ether (ETH). A restriction on CYS transfers does not freeze that ether. That distinction explains why a frozen address is only part of the recovery story. [2]
The foundation says the problem was confined to the bridge, the service that moves tokens across networks. It says Cysic’s main blockchain kept operating and existing assets in user wallets were unaffected. [1]
“Existing user assets were not stolen.”
Cysic Incident Report [1]
That statement concerns assets already held in wallets. It does not mean the unauthorized tokens went unsold, or that the proceeds have been recovered.
A working network still needs a trusted token
Cysic runs a computing network, including work that checks blockchain calculations. Its documentation says CYS pays for services and rewards the operators supplying computing power. That gives the token a role beyond trading. [3]
Computing providers also reserve or stake CYS to participate, according to the project’s token rules. Those uses can create demand, but they do not protect the token market from unauthorized issuance or make incident losses disappear. [4]
The report?s practical restriction is the closed bridge. The report provides no reopening date: services are to resume only after the security review. It also leaves actual losses and further handling of the frozen tokens for later findings. [1]
Cysic has contained one wallet’s remaining tokens. The harder task is establishing what was lost, what can be retrieved and whether the repaired bridge can safely reopen.