Cysic says the bridge database was accessed first
Cysic’s preliminary report says the attacker gained access to a database used by services supporting the bridge. The attacker then used a flaw in the bridge’s message-processing logic to submit a false instruction and create 10 million CYS on BNB Chain.
This sequence is the project’s current explanation, not a final independent audit. Cysic says the incident affected bridge processing and token creation rather than the mainnet itself. The outside security review still needs to confirm the full path of the attack.
The attacker moved 7.2 million CYS before the freeze
Onchain records reviewed by The Block show that 7.2 million of the new tokens left the receiving address through sales or transfers. Cysic blacklisted the address 76 minutes after the unauthorised creation, leaving about 2.8 million CYS frozen and unable to move.
The 10 million figure is the number of tokens created, not the confirmed dollar loss. The 7.2 million figure describes tokens that moved before the freeze. Neither number alone proves how much value the attacker finally kept.
Part of the proceeds reached Ethereum
The attacker exchanged some of the tokens and moved about 306.6 ETH to Ethereum through Mayan, deBridge and SWFT’s Bridgers service. That ETH was worth about $727,000 when the transfers were reported. It is a measured movement of proceeds, not yet a final loss calculation for the complete incident.
Cysic says existing CYS and other assets already held in user wallets were not stolen. That statement also comes from the project’s preliminary report and should remain separate from the independent investigation now under way.
Confirmed response steps
- The cross-chain bridge was suspended.
- About 2.8 million unsold CYS were blacklisted and frozen.
- An external security firm was brought into the investigation.
- Cysic reported that its mainnet and existing user-wallet assets remained unaffected.
The bridge remains paused during the review
Cysic suspended the bridge, froze the remaining 2.8 million tokens and hired an outside security company. The next report needs to explain how the database was reached, why the false message was accepted and whether further controls have been added before the bridge returns.
Until that work is complete, the confirmed sequence is limited: bridge access was compromised, 10 million CYS were created, 7.2 million moved before the freeze and part of the proceeds reached Ethereum. The final financial loss is still under investigation.
Dit artikel is alleen voor informatieve doeleinden en is geen beleggingsadvies.
admin_wcBijdrager · World-CryptMeer van
