Syscoin Bridge
Summary
Syscoin Bridge is the cross-chain bridge infrastructure connecting Syscoin's UTXO chain and its Network Enhanced Virtual Machine (NEVM) EVM-compatible layer. In June 2026, an attacker exploited a proof-validation parsing flaw in the bridge relay, minting approximately 5 billion unauthorized SYS tokens valued at roughly $10 million and inflating the circulating supply by an estimated 568 percent. The bridge was paused immediately and the attacker subsequently returned the funds following private whitehat negotiations, though the incident raised serious questions about audit coverage of the relay component.
Connected Entities
1 entities · 10 linked investigationsTimeline(8 events)
2021-12-06
Syscoin NEVM (Network Enhanced Virtual Machine) EVM layer reached mainnet at block 1,317,500.
CoinTelegraph2026-05-13
Binance announced delisting of SYS alongside four other altcoins, effective May 27, 2026.
Binance official announcement2026-05-27
Binance spot trading pairs for SYS removed. SYS dropped approximately 34% around the announcement.
CoinCu / Binance2026-06-07
Attacker submitted malformed SPV proof to Syscoin bridge relay. Approximately 5 billion SYS minted on UTXO chain without corresponding NEVM burn. Initial output sent to sys1qgaelv690g7wwp2xchfdh0enf5uewzq5sm9wvcw, then split to two wallets. Syscoin published preliminary postmortem on social media the same evening.
Rekt News / Halborn2026-06-08
Syscoin formally halted all bridge operations. Halborn released detailed technical breakdown of the exploit. SYS token declined over 20% within 24 hours.
Crypto Times / Halborn2026-06-09
Syscoin published public recovery address (sys1qdytsq5am9a7y6hweenl925g3yxtlrvl9fls0yg) and confirmed attacker had initiated whitehat contact. Private bounty negotiations began.
Rekt News2026-06-09
Two on-chain recovery transactions confirmed, with the unauthorized 5 billion SYS returned to the Syscoin recovery address. Bounty terms not publicly disclosed.
Rekt NewsDecision Log
- hash: 8QoP3J73bTC3YAt1AcLsQrqqBaW35nXiFULBSDALngh5
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/14/2026, 5:12:43 PM
last updated: 6/14/2026, 5:12:58 PM
avoid.net — verified advice for a post-truth world