KuCoin Suspends Cysic Token Deposits After an Attacker Mints 10 Million CYS and Bridges Out $727,000

MakeCryippreferred on

• An attacker exploited Cysic’s cross-chain bridge on October 17, 2026, minting 10 million unauthorized CYS tokens on BNB Smart Chain
• The attacker bridged roughly 306.6 ETH, worth about $727,000 at the time, over to Ethereum, while roughly 2.8 million of the minted CYS remains frozen in a blacklisted address
• KuCoin temporarily closed CYS deposits on October 18, 2026, citing essential maintenance, while Cysic’s own foundation confirmed the exploit and cautioned that the minted-token count does not by itself represent the final dollar loss

KuCoin temporarily closed deposit service for the Cysic token, CYS, on October 18, 2026, according to the exchange’s own announcement, a move that followed an exploit of the Cysic protocol’s cross-chain bridge the previous day. An unauthorized mint allowed the attacker to create 10 million CYS tokens on BNB Smart Chain without backing collateral, then move a portion of the resulting value off the chain entirely.

The exploit itself struck on October 17, 2026, when the attacker found a way to mint CYS through Cysic’s bridge infrastructure without going through the legitimate deposit process the bridge is designed to require. Once the tokens existed, the attacker began converting a share of them into other assets, routing several of the swaps through OKX’s decentralized exchange aggregator before ultimately bridging approximately 306.6 ETH, worth roughly $727,000 at prevailing prices, over to the Ethereum network. On-chain records on BscScan and Etherscan corroborate the mint, the subsequent token sales, and the ETH transfer to Ethereum.

Cysic’s own foundation moved quickly to contain the damage, blacklisting an address still holding about 2.8 million of the unauthorized CYS and restricting it from being transferred further. Importantly, Cysic’s foundation was careful to note in its own incident report that the 10 million minted tokens do not, on their own, represent the final dollar value of the loss, since much of that minted supply never left the chain or was frozen before it could be converted into other assets. The confirmed $727,000 figure reflects only the ETH that the attacker successfully bridged out, not a total damage estimate for the incident.

KuCoin’s notice gave no indication of when CYS deposits would resume, describing the suspension only as essential maintenance rather than explicitly naming the exploit as the cause, though the timing lines up directly with Cysic’s own disclosure. Exchanges routinely pause deposits and withdrawals for a token after a bridge or minting exploit as a precaution, since allowing deposits to continue could let an attacker move improperly minted tokens onto the exchange and attempt to sell them before the scope of an incident is fully understood.

Cross-chain bridges, the infrastructure that lets tokens move between otherwise incompatible blockchains, have remained one of the most frequently targeted categories of decentralized finance infrastructure, since they typically require a bridge contract to mint or release tokens on one chain whenever a matching amount is locked or burned on another, creating a single point where a flaw in that accounting logic can be exploited to create tokens from nothing. The announcement, published on KuCoin’s official notice board, said the exchange would continue monitoring the situation and update users once deposits reopen.