{"id":"syscoin-bridge-unauthorised-mint-jun-2026","category":"breach","status":"closed","title":"Syscoin bridge exploit mints 5 billion SYS; attacker returns the tokens, bridge still paused","tldr":"Syscoin's bridge accepted a malformed proof on 7 June 2026 and about 5 billion SYS (reported as about US$10m) were created. Syscoin says all were returned and burned. The bridge was still paused as of its 15 June report. Holders need do nothing.","summary":"On 7 June 2026 an attacker exploited the bridge between Syscoin's main network and its NEVM layer. The two components, Syscoin Core and the NEVM relay, read the same transaction differently, so the relay accepted a malformed burn proof and released about 5 billion SYS. That was more than five times the roughly 891 million in circulation, according to one report. Halborn valued the tokens at about US$10 million; another outlet cited a lower figure of about US$8.6 million. Syscoin paused the bridge and contacted the attacker on-chain. Its postmortem of 15 June says the attacker returned all 5 billion SYS to Syscoin's recovery address and the coins were burned, so the supply is back to normal. It reports no loss of funds, no arrests and no law enforcement action. The relay now rejects ambiguous burns. Core-side fixes were still being made, and the bridge stayed closed pending review. We found no later report of it reopening.","action":"Nothing for you to do. If you hold SYS, you can use exchanges where native deposits have resumed, but the bridge itself stays closed until Syscoin announces otherwise.","product":"Syscoin (SYS) UTXO-to-NEVM bridge","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":[],"tags":["syscoin","sys","crypto","bridge","nevm","exploit","unauthorised-mint"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Technical Postmortem: Syscoin Bridge Incident, Recovery, and Remediation","url":"https://syscoin.org/news/technical-postmortem-syscoin-bridge-incident-recovery-and-remediation","by":"Syscoin","date":"2026-06-15"},{"kind":"research","title":"Explained: The Syscoin Bridge Hack (June 2026)","url":"https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026","by":"Halborn","date":"2026-06-08"}],"started":"2026-06-07","closed":"2026-06-15","created":"2026-11-03T21:50:45.726Z","updated":"2026-11-03T21:50:45.726Z","cve_notes":[],"timeline":[{"at":"2026-06-15","added":"2026-11-03T21:48:54.459Z","kind":"all-clear","text":"Syscoin's postmortem said the attacker returned all 5 billion SYS to its recovery address and the coins were burned, restoring the expected supply. The relay now rejects ambiguous burns, Core-side changes were still being made, and the bridge stayed paused.","url":"https://syscoin.org/news/technical-postmortem-syscoin-bridge-incident-recovery-and-remediation","by":"Syscoin","patch":"na"},{"at":"2026-06-08","added":"2026-11-03T21:48:54.459Z","kind":"other","text":"Halborn put the value of the minted tokens at about US$10 million and said the cause was a parsing error in the bridge relay, which accepted a crafted proof of a burn that never happened. It said the attacker spread the tokens across several wallets and that Syscoin worked with exchanges and partners to freeze them.","url":"https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026","by":"Halborn","patch":"na"},{"at":"2026-06-07","added":"2026-11-03T21:48:54.459Z","kind":"disclosed","text":"Syscoin responded to an exploit of its UTXO-to-NEVM bridge that created about 5 billion unauthorised SYS on the UTXO side. The bridge was paused.","url":"https://syscoin.org/news/technical-postmortem-syscoin-bridge-incident-recovery-and-remediation","by":"Syscoin","patch":"na"}],"url":"https://hard.fyi/live/syscoin-bridge-unauthorised-mint-jun-2026/","json":"https://hard.fyi/api/live?id=syscoin-bridge-unauthorised-mint-jun-2026"}