Syscoin bridge exploit mints 5 billion SYS; attacker returns the tokens, bridge still paused
Syscoin's bridge accepted a malformed proof on 7 June 2026 and about 5 billion SYS (reported as about US$10m) were created. Syscoin says all were returned and burned. The bridge was still paused as of its 15 June report. Holders need do nothing.
Nothing for you to do. If you hold SYS, you can use exchanges where native deposits have resumed, but the bridge itself stays closed until Syscoin announces otherwise.
What’s happening
On 7 June 2026 an attacker exploited the bridge between Syscoin's main network and its NEVM layer. The two components, Syscoin Core and the NEVM relay, read the same transaction differently, so the relay accepted a malformed burn proof and released about 5 billion SYS. That was more than five times the roughly 891 million in circulation, according to one report. Halborn valued the tokens at about US$10 million; another outlet cited a lower figure of about US$8.6 million. Syscoin paused the bridge and contacted the attacker on-chain. Its postmortem of 15 June says the attacker returned all 5 billion SYS to Syscoin's recovery address and the coins were burned, so the supply is back to normal. It reports no loss of funds, no arrests and no law enforcement action. The relay now rejects ambiguous burns. Core-side fixes were still being made, and the bridge stayed closed pending review. We found no later report of it reopening.
- What
- Breach
- Affects
- Syscoin (SYS) UTXO-to-NEVM bridge
- Fixed in
- No fix yet
- Since
- 7 June 2026
- Closed
- 15 June 2026
Timeline
- All clearNothing to patch
Syscoin's postmortem said the attacker returned all 5 billion SYS to its recovery address and the coins were burned, restoring the expected supply. The relay now rejects ambiguous burns, Core-side changes were still being made, and the bridge stayed paused.
- UpdateNothing to patch
Halborn put the value of the minted tokens at about US$10 million and said the cause was a parsing error in the bridge relay, which accepted a crafted proof of a burn that never happened. It said the attacker spread the tokens across several wallets and that Syscoin worked with exchanges and partners to freeze them.
- Made publicNothing to patch
Syscoin responded to an exploit of its UTXO-to-NEVM bridge that created about 5 billion unauthorised SYS on the UTXO side. The bridge was paused.
Sources
- Technical Postmortem: Syscoin Bridge Incident, Recovery, and RemediationSyscoin · 15 June 2026
- Explained: The Syscoin Bridge Hack (June 2026)Halborn · 8 June 2026