According to Syscoin's postmortem published on X, an attacker recently exploited a validation flaw in the bridge relay path, minting approximately 5 billion SYS tokens without authorization. The unauthorized tokens, valued at just under $10 million at the time, sent SYS into a 20% freefall.
The attacker sent the stolen funds to a single address before splitting them across two wallets holding 4 billion and 1 billion SYS respectively. Syscoin immediately paused the bridge and contacted exchanges to blacklist the tainted tokens. The team identified the affected validation path and implemented a fix pending security review, while blockchain analytics firm Hupzy noted the incident represents a recurring structural problem for the bridge model.