Syscoin Bridge
Last changed 2026-10-27 · Re-researched — Re-researched in full by the investigator agent at a reader's request; the text was rewritten from new research. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2F5RCz…6b4uSummary
Syscoin Bridge is the two-way peg connecting the Syscoin UTXO chain to its EVM-compatible NEVM layer, using Simplified Payment Verification (SPV) proofs to mint and burn SYS across chains. In June 2026 a proof-validation flaw in the bridge's relay path allowed an attacker to mint roughly 5 billion unauthorized SYS with no corresponding burn, worth an estimated $8.5-10 million at the time; the funds were later returned and burned, but the bridge remained paused pending remediation. The project's broader history includes a 2014 crowdsale in which 750 BTC held in escrow were allegedly misappropriated, and a May 2026 Binance delisting that preceded the bridge incident by about two weeks.
Connected Entities
9 entities · 59 linked investigations- Syscoin→mentioned with→Binance(65%)
- Syscoin→mentioned with→Bitcoin(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
- Syscoin Bridge→mentioned with→Bitcoin(65%)
- Syscoin Bridge→mentioned with→Binance(70%)
- Syscoin Bridge→mentioned with→Syscoin(80%)
- LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Bitcoin(65%)
- LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(80%)
- Syscoin Bridge→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(60%)
- + 3 more
3 submissions awaiting moderator review.
Timeline(9 events)
October 2014
Approximately 750 BTC raised in Syscoin's crowdsale and held in escrow by Moopay Ltd ('Moolah'), operated by Ryan Kennedy under the alias Alex Green, were allegedly misappropriated; blockchain analysis found related transfers concentrated around mid-October 2014.
CoinDeskFebruary 2015
Ryan Kennedy and Chelsea Hopkins were arrested by UK authorities in connection with the Mintpal/Moolah-related bitcoin losses, including the Syscoin escrow funds.
Finance MagnatesMay 2026
Binance ended SYS spot trading as part of a delisting of five tokens, with SYS leading intraday losses among them.
BeInCrypto / Whale Alert7 June 2026
Syscoin identified and responded to an exploit of its cross-chain bridge, in which approximately 5 billion unauthorized SYS were minted on the UTXO side without a matching NEVM burn; a preliminary postmortem with transaction hashes was published the same day.
Syscoin Foundation technical postmortem8 June 2026
Halborn published an independent technical analysis of the bridge exploit, attributing it to a parsing error in the relay's proof-validation code.
HalbornJune 2026
Syscoin published an on-chain recovery address and reported contact with the attacker regarding a possible whitehat bounty.
Rekt NewsJune 2026
Syscoin told exchanges it was safe to reopen native SYS deposits and withdrawals, separate from the still-paused cross-chain bridge.
Cryptopolitan15 June 2026
Syscoin published a fuller technical postmortem describing the cross-layer interpretation mismatch root cause, confirming the funds had been returned and burned, and detailing remediation steps; the bridge itself remained paused pending further review.
Syscoin FoundationDecision Log
- slot 426459475 · hash 8QoP3J73bTC3YAt1AcLsQrqqBaW35nXiFULBSDALngh5
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 0 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/14/2026, 5:12:43 PM
last updated: 10/27/2026, 8:55:42 PM
3 viewsavoid.net — verified advice for a post-truth world