Syscoin experiences security incident with 5 billion unauthorized tokens

Syscoin reports that its Bridge system has been shut down following a security incident in which approximately 5 billion SYS tokens were created without authorisation. The protocol investigated the incident and states that an attacker exploited a validation flaw in the Bridge’s operation. This led to the system incorrectly accepting a transaction proof and subsequently creating this huge amount of unauthorised tokens via the UTXO Bridge path.

Attacker moves stolen funds

After creating the tokens, the attacker moved the proceeds and split them up. About 4 billion SYS and 1 billion SYS are linked to two large addresses that are now considered tainted. Syscoin says it has identified the compromised validation path and is working on a fix.

In the meantime, the protocol is coordinating with exchanges and other ecosystem partners. These parties must block, freeze or monitor SYS deposits linked to the tainted UTXO trail. This helps prevent further spread of the unauthorised tokens.

Bridge remains closed for now

The Syscoin Bridge system will remain paused until the security issue is fully resolved. The protocol advises users not to interact with the Bridge while it is offline. This is a precautionary measure to prevent further exploitation.

These security incidents shake confidence in blockchain systems. While Syscoin responded quickly by pausing the system and coordinating with partners, this incident shows how critical robust validation mechanisms are for cross-chain communication.