Minting 10 Million Tokens Out of Thin Air: Is the Cysic Cross-Chain Bridge a Hacker's ATM?
- Core Viewpoint: The Cysic cross-chain bridge was attacked due to a verification logic vulnerability. The attacker minted 10 million CYS without authorization and cashed out approximately $727,000 within about 28 minutes, exposing the systemic risks of cross-chain bridge verification mechanisms.
- Key Elements:
- The attacker gained access to the cross-chain bridge's database permissions and exploited a message-processing logic vulnerability to submit a fraudulent minting message, minting 10 million CYS on BNB Chain without authorization, accounting for 1% of the total supply.
- Within about 28 minutes of the minting, the attacker sold approximately 7.2 million CYS through 15 transactions, exchanging them for about 588,300 USDT and 220 BNB, of which 12 transactions were executed via the OKX DEX aggregator.
- The cashed-out funds were bridged to Ethereum via SWFT, Mayan, and deBridge, totaling approximately 306.6 ETH (about $727,000).
- The project team only blacklisted the receiving address about 76 minutes after the anomalous minting, by which time only about 2.8 million CYS remained in the address, accounting for 28% of the anomalously minted amount.
- Founded in 2022, Cysic focuses on ZK hardware acceleration and decentralized computing networks, with cumulative funding of $18 million and a total CYS supply of 1 billion tokens.
- Since the beginning of this year, cross-chain security incidents involving KelpDAO, Verus, Across, Wanchain, and others have resulted in combined losses exceeding $323 million, underscoring the persistent security risks of cross-chain bridges.
Original | Odaily（@OdailyChina）
Author | Asher（@Asher_ 0210）
The cross-chain bridge is in trouble again.
On October 18, Cysic Foundation released an incident report confirming that its cross-chain bridge was attacked on October 17, with 10 million CYS unauthorized minted, of which approximately 7.2 million were sold before the address was frozen. Cysic has suspended cross-chain bridge services and stated that the attack did not affect the Cysic mainnet, nor did it directly steal assets already held in user wallets.
Why could these tokens be generated out of thin air, and how did the attacker manage to cash out? Odaily will start with Cysic's project background to sort through the course of this attack and the root cause of the vulnerability.
Cysic: From ZK Hardware Acceleration to a Decentralized Computing Network
Cysic was founded in 2022, initially focusing on zero-knowledge proof (ZK) hardware acceleration, reducing the cost of proof generation and shortening computation time through specialized chips and software optimization, before gradually expanding into a decentralized computing network for tasks such as ZK proof generation and AI inference.
Cysic has completed two funding rounds to date, totaling $18 million, including:
- On February 17, 2023, Cysic announced the completion of a $6 million seed round led by Polychain Capital, with participation from Hashkey, SNZ Holding, A&T Capital, ABCDE, Web3.com, and others;
- On May 24, 2024, Cysic announced the completion of a $12 million pre-A round led by HashKey Capital and OKX Ventures.
Its native token CYS is used for computing service payments, staking, and node rewards, with a supply of 1 billion. The cross-chain bridge that was attacked is the channel through which CYS flows between the Cysic mainnet and networks such as BNB Chain.
Within 76 Minutes, How Did the Attacker Complete the Minting and Cash-Out?
At 20:31:38 Beijing time on October 17, the attacker unauthorized minted 10 million CYS on BNB Chain through the Cysic cross-chain bridge, accounting for 1% of the total token supply.
About 5 minutes after the minting, the attacker began selling the tokens. According to The Block's review of on-chain records, from 20:36 to 20:41, the attacker sold 5.65 million CYS through 11 transactions in exchange for approximately 588,300 USDT; from 20:57 to 20:59, the attacker sold the remaining 1.55 million CYS through 4 transactions in exchange for approximately 220 BNB. Of the 15 transactions above, 12 were executed via the OKX DEX aggregator, with orders split across trading platforms such as PancakeSwap. From the abnormal minting to the sale of approximately 7.2 million CYS, the attacker took only about 28 minutes.
Subsequently, the attacker transferred the proceeds to Ethereum through cross-chain services such as SWFT, Mayan, and deBridge, receiving a total of approximately 306.6 ETH, worth about $727,000, and further transferred them to another wallet.
It was not until 21:47:52 that evening that the project team added the receiving address to the blacklist of the CYS token contract. By then, about 76 minutes had passed since the abnormal minting, and only about 2.8 million CYS remained in the address, accounting for 28% of the total abnormally minted amount.
The prerequisite for the attacker to cash out was to first have the cross-chain bridge generate a batch of CYS that should never have existed. So why did the Cysic cross-chain bridge accept this minting request?
Cross-Chain Bridge Verification Fails, False Request Triggers Token Minting
Under normal circumstances, a cross-chain bridge can only mint the corresponding tokens on the target chain after confirming that a real asset lock or burn has occurred on the source chain.
However, according to Cysic's preliminary investigation, the attacker gained access to the database permissions supporting the cross-chain bridge service and exploited a message-processing logic vulnerability to submit a false minting message, ultimately generating 10 million CYS on BNB Chain with no corresponding asset backing.
How the attacker obtained database permissions and why the false message passed verification remain to be disclosed in the full investigation report.
The investigation is not yet complete, but the abnormally minted tokens have already entered the market. For token holders, "wallet assets were not stolen" does not eliminate the selling pressure brought by the abnormal minting. How this batch of tokens will be handled and whether the project team will bear the losses remain without a clear plan.
Cross-Chain Is a Necessity, but Who Bears the Security Cost?
The Cysic attack is not an isolated case. This year alone, the KelpDAO cross-chain bridge incident involved losses of approximately $292 million; the Verus cross-chain bridge was attacked twice in May and July, involving approximately $11.58 million and $7.54 million respectively; Across and Wanchain also experienced security incidents of approximately $4.5 million and $9.3 million respectively. These five incidents alone involve amounts exceeding $323 million, before deducting recovered funds.
The demand for cross-chain will not disappear, but each additional asset transfer channel also means another set of verification mechanisms that must be trusted. When projects enjoy the convenience of multi-chain liquidity while the losses from security incidents are left for the market to bear, cross-chain bridges are both an industry necessity and potentially a bomb whose detonation timing users cannot predict.
