Syscoin has paused its bridge after a security incident created about 5 billion unauthorized SYS outputs through its UTXO bridge path.
Summary
- Syscoin paused its bridge after a validation issue created about 5B unauthorized SYS outputs.
- The team traced major tainted balances to two UTXO addresses holding about 4B and 1B SYS.
- Syscoin said exchanges and partners were asked to freeze, blacklist, or monitor linked deposits.
The project said an attacker exploited a validation issue in the bridge flow. The flaw caused the system to incorrectly accept or read a transaction proof and create SYS output that should not have been produced.
Meanwhile, SYS traded near $0.00165 after the update, with a market cap of about $9.7 million, according to CoinGecko. The token was down sharply from its all-time high of $1.30, showing weak market confidence around the project. The token has fallen nearly 10% in the last 24 hours.
Syscoin bridge paused during investigation
Syscoin said the bridge remains paused while the team investigates the incident, completes a fix, and decides how to address the unauthorized SYS output.
“The Syscoin bridge is currently paused while the team investigates,” the project said in its preliminary postmortem.
The team said users should not interact with the bridge while it remains offline. It also said the incident is being treated as a top priority.
Syscoin said it has already identified the affected validation path. The team said it has a fix in place, but review and implementation are still ongoing.
5B SYS output traced on UTXO chain
According to Syscoin, the attacker created an unauthorized output of about 5B SYS through the UTXO bridge path.
The funds were first sent to one address before being spent and split into other outputs. Syscoin said the largest tainted balances appear linked to two addresses holding about 4B SYS and 1B SYS.
The team published the initial UTXO transaction, the later spend, and the split transaction. It said it is tracing the funds across the UTXO trail.
Syscoin also said it is working with exchanges and ecosystem partners. The goal is to stop tainted SYS from being deposited, traded, or spread further.
Exchanges asked to monitor tainted SYS
Syscoin said it contacted exchanges and relevant partners after the incident. The project asked them to blacklist, freeze, or closely monitor SYS deposits tied to the tainted outputs.
The team also asked partners to watch descendant spends from the affected UTXO trail. This step aims to reduce the chance that the unauthorized SYS reaches open markets.
The incident comes as cross-chain bridge security remains under close watch across crypto. Bridges often handle funds across different chains, making validation errors costly when attackers find a weak path.
Related reports show that bridge attacks have remained active in 2026, with several cross-chain systems hit in recent months.
Related crypto.news coverage previously described Syscoin as a dual-layer blockchain that combines Bitcoin-style security with Ethereum-like smart contract support.
That background matters because the latest incident involved Syscoin’s bridge system, which connects activity across its native UTXO side and related blockchain infrastructure.
Separate market reports have also tracked rising bridge risks across the wider crypto sector. Recent cases include attacks on cross-chain systems where flaws or key failures allowed attackers to move large amounts of assets.
For Syscoin, the next update will likely focus on the final remediation plan. The team said it will share more information after it completes the fix and decides how to neutralize the unauthorized output.
