On June 7, 2026, attackers exploited a validation flaw in Syscoin's cross-chain bridge to mint approximately 5 billion unauthorized SYS tokens worth $9 million on the UTXO chain, roughly five times the circulating supply of 891 million SYS. Syscoin paused the bridge and is coordinating with exchanges to prevent cashouts. The bridge wrongly accepted a fraudulent transaction proof as legitimate, minting tokens without backing.
Syscoin bridge exploit
- ▪The Syscoin team paused the Syscoin bridge following the exploit
- ▪The unauthorized 5 billion SYS tokens minted in the Syscoin exploit represented approximately $9 million in value at the time the exploit was reported
- ▪The Syscoin team is coordinating with exchanges to prevent the exploited funds from being cashed out
- ▪The Syscoin attacker divided the 5 billion SYS tokens into two wallets with a 4 billion to 1 billion SYS split
- ▪The Syscoin exploit occurred on June 7, 2026
- ▪Exploiters minted approximately 5 billion unauthorized SYS tokens on the Syscoin bridge without authorization or backing
Technical vulnerability details
- ▪The Syscoin bridge wrongly accepted a transaction proof, treating a fraudulent submission as legitimate and minting approximately 5 billion SYS on the UTXO side
- ▪The Syscoin bridge exploiters exploited a validation flaw in the cross-chain bridge to create the unauthorized SYS tokens
SYS token price impact
- ▪The unauthorized 5 billion SYS tokens minted in the exploit dwarf Syscoin's circulating supply of 891 million SYS by roughly five times
- ▪Approximately 12% of the SYS token's market cap value was withdrawn as of June 8, 2026
- ▪As of June 8, 2026, the SYS token market cap was approximately $1.47 million, ranking 1,720th among tokens tracked by CoinMarketCap
- ▪The SYS token endured a double-digit percentage point drop in the 24 hours following the June 7, 2026 exploit disclosure
Protocol activity metrics
- ▪Syscoin's total value locked dropped to zero from a 2022 peak above $10 million
- ▪The Syscoin chain recorded only 14 active addresses and 73 transactions over the 24 hours prior to June 8, 2026
- ▪As of June 8, 2026, the Syscoin chain's total value locked in DeFi protocols was effectively zero according to Defillama
Bridge restoration timeline
- ▪As of June 8, 2026, the Syscoin bridge remained offline
2025 cross-chain security trends
- ▪Code vulnerabilities drove 66% of May 2026 crypto security losses at $45.13 million
- ▪Bridge exploits accounted for $28.62 million of the May 2026 crypto security losses, the largest dollar amount by incident type
- ▪In May 2026, CertiK counted 60 confirmed security incidents across the crypto industry totaling $68.3 million in gross losses
- ▪As of June 1, 2026, 14 major bridge and cross-chain exploits in 2026 had drained a cumulative $340.7 million according to PeckShield
Story comments
Loading comments…