Syscoin Bridge — SPV Proof Parsing Exploit (Full Recovery)

Timeline: On June 7, 2026 at 08:37:05 UTC, an attacker submitted a malformed SPV proof to Syscoin's NEVM-to-UTXO bridge relay. The relay's parsing code interpreted the malformed structure as valid, treating a nonexistent NEVM burn as confirmed and authorizing a mint of 5,000,000,000 SYS — equivalent to approximately $8.56M at the June 7 closing price of $0.00171187/SYS. This inflated the circulating supply by 568% and diluted every existing holder. The attacker received the tokens at sys1qgaelv690g7wwp2xchfdh0enf5uewzq5sm9wvcw, moved the full balance out in a subsequent transaction, then split the funds across two holding addresses (~4B and ~1B SYS). Syscoin paused the bridge within hours, published a detailed preliminary postmortem the same evening naming the flaw, transaction hashes, and tainted addresses, and coordinated with exchanges for blacklisting. Halborn published a technical breakdown the following morning classifying the root cause as an SPV proof parsing vulnerability — the same attack class as the 2022 Nomad Bridge and BNB Bridge hacks. Syscoin publicly posted a whitehat recovery address on June 9. The attacker made contact and accepted a bounty arrangement; all 5B SYS were subsequently returned via two confirmed recovery transactions. Bounty terms have not been made public.