Breaches and incidentsBriefChecked against a primary source
Syscoin bridge: Core and relay parsed the same burn differently, 5B SYS released
7 Jun 2026: about 5B SYS (about USD 9M to 10M) released without authorization on the UTXO side.
- Disclosed
What happened
- Root cause per Syscoin’s post-mortem: a burn transaction with two asset commitments on the same output. Syscoin Core could read it as the attacker’s custom asset, while the NEVM relay read it as native SYS (assetGuid 123456) and SyscoinVaultManager released native SYS. No private keys were compromised.
- Attribution: none.
- Response: the attacker returned all 5B SYS after on-chain contact. Syscoin burned it to an OP_RETURN output. The relay now rejects ambiguous and duplicate-commitment burns. Bridge still paused at last report.
Sources
- https://syscoin.org/news/technical-postmortem-syscoin-bridge-incident-recovery-and-remediation
- https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.