The attacker returned the full amount after on-chain contact from the team, which burned the tokens and kept the bridge offline while consensus and relay fixes undergo final review.
Syscoin said a flaw in its UTXO-to-NEVM bridge led to the unauthorized release of about 5 billion SYS after two parts of its infrastructure interpreted the same transaction payload differently. The team said it detected the attack on June 7, traced the funds across UTXO addresses, contacted the attacker on-chain with a recovery address and warning, and later received the full amount back before burning the tokens to restore supply to pre-exploit levels. A technical postmortem published June 15 said the attacker used two asset commitments pointing to the same output, with one referencing native SYS and the other a custom test token, causing Syscoin Core and the NEVM relay to resolve the transaction differently and prompting the vault contract to release the tokens. Native SYS deposits and withdrawals at exchanges resumed on June 10, but the bridge remains paused pending final validation as Syscoin adds relay checks for duplicated or ambiguous burn transactions and works on Core-side consensus changes. The incident came against a weak market backdrop for SYS and renewed attention on bridge security, a category that PeckShieldAlert said accounted for 14 major exploits totaling $340.7 million as of June 1, 2026.