An attacker exploited a validation flaw in the Syscoin Bridge and generated approximately 5 billion SYS tokens with no real backup on the UTXO chain.
This was reported by the Syscoin team in a preliminary postmortem published on June 7, in which it details the mechanism of the incident and the measures taken so far.
According to the document, the bridge repeater accepted and interpreted incorrectly a proof of transaction. That led the system to treat the operation as valid and credit an unauthorized output of SYS tokens through the bridge’s UTXO path. The resulting funds were transferred and divided into subsequent transactions.
The Syscoin team indicates that the compromised tokens are currently concentrated in two directions: one with approximately 4,000 million SYS and another with close to 1,000 million SYS, whose value, at the current price of the token, would exceed 8 million dollars. The SYS price has fallen 14% in the last 24 hours, after the incident.
According to the team, both addresses and their derived transactions are being actively tracked by the team.
Yesyscoin is a dual-layer blockchain network compatible with the Ethereum Virtual Machine (EVM) and with the Bitcoin chain through proof of work. Its native bridge allows assets to be moved between the UTXO layer and the NEVM layer, making it critical ecosystem infrastructure.
Funds tracked and exchanges alerted
Given the incident, The team notes that it has contacted exchanges and ecosystem partners to request the block.freezing or strict monitoring of any SYS deposit linked to the compromised UTXO trace and its derived transactions. The bridge remains paused while the investigation is completed.
The team maintains that it has already identified the affected validation path and has a fix ready. The priority, according to the postmortem, is to complete the implementation and review of the bug, in addition to determining the correct process to rectify unauthorized output and neutralize its impact on the network.
Syscoin warns users that do not interact with the bridge while it remains paused, and announces that it will publish new updates as the investigation and remediation progress.