OAK — OnChain Attack Knowledge

Worked example · 2026-06

Syscoin bridge — SPV-proof-parsing flaw mints ~5B SYS without a burn — Syscoin UTXO ⇄ NEVM — 2026-06-07

Loss
~5,000,000,000 SYS minted (~$8.56M–$10M notional); ~$0 realised — funds returned. An attacker exploited a proof-parsing flaw in Syscoin's cross-chain bridge between the Syscoin UTXO chain and the Syscoin NEVM (EVM) side, causing the NEVM bridge to accept an invalid proof as valid and mint ~5 billion SYS without a corresponding burn on the UTXO side. The minted tokens were valued at roughly $8.56M–$10M at the time. Syscoin paused the bridge within hours, coordinated with exchanges and partners to freeze the tainted balances, offered a recovery address with a white-hat bounty, and the funds were returned through two on-chain transactions — so the realised loss was approximately zero, while the notional supply event was ~5B SYS. As with every "mint from nothing" bridge event, OAK records both: the notional mint is bounded only by the bridge's broken predicate, the realised loss by what the attacker could exit before containment (here, nothing, because of speed of response and the attacker's white-hat posture).
OAK Techniques observed
OAK-T10.002 (Message-Verification Bypass — the bridge's NEVM-side verification logic accepted a cross-chain message whose **SPV / Merkle proof was invalid but structured to be misread as valid by the parser. Per Halborn, "the attacker didn't forge a valid proof — they forged something the parsing code would read as a valid proof": the failure is at the proof-deserialisation / parsing layer, upstream of the cryptographic check, so a malformed input bypassed validation entirely and the bridge minted SYS on NEVM with no matching UTXO-side burn. This is a proof-parsing-ambiguity sub-shape of T10.002, distinct from Nomad's trusted-root-initialised-to-zero, Wormhole's missing-guardian-account-validation, Verus's missing-source-amount-validation, and MAP Protocol's abi.encodePacked hash-collision — but the same class: contract-side message verification admits a message it should reject. Halborn explicitly drew the Nomad Bridge 2022** comparison. See techniques/T10.002-message-verification-bypass.md). The downstream "release/mint without lock/burn" is the canonical T10.002 indicator, not a separate technique.
Attribution
pseudonymous (white-hat / grey-hat). The attacker's UTXO addresses were named in Syscoin's same-evening preliminary post-mortem (initial sys1qgaelv690g7wwp2xchfdh0enf5uewzq5sm9wvcw; final split across sys1q2k482wnachkgky4lw60973p4vcf7xlh9kzpv33 holding ~4B and sys1qx6jjkq89sdaxftfgre3m0nv7vjfd4jeakg5t38 holding ~1B). The minted SYS was returned, consistent with a white-hat / negotiated-bounty resolution; no named individual or group. Key transactions were published by Syscoin: mint a5b422ab…fa184, spend ba6798fa…d5ff4, split 31e12b0d…117113c. The exploit occurred 2026-06-07; Halborn's technical breakdown landed the morning of 2026-06-08.
Key teaching point
A bridge's cryptographic proof check is only as sound as the parser that feeds it. Syscoin's verification was not broken at the cryptographic layer — the attacker never produced a genuinely valid proof. The break was at the parsing layer: a malformed proof was deserialised in a way that the downstream check then treated as legitimate, so validation was bypassed without ever being defeated. This is the same lesson as Nomad (a routine change made the verification predicate accept everything) restated at the deserialisation boundary: the message-verification attack surface includes how the proof bytes are parsed, not just whether the proof is valid. Auditors and bridge designers should fuzz the proof parser with malformed and adversarially-structured inputs as a first-class check, treat "proof parses successfully" and "proof is cryptographically valid" as two separate invariants, and instrument a post-mint invariant that every NEVM mint corresponds to a confirmed UTXO-side burn. Syscoin's response — pause within hours, exchange-coordinated freeze, recovery-address bounty, full return — is also a reference template for fast containment turning a ~$10M notional mint into ~$0 realised loss.

Summary

Syscoin runs a dual-chain architecture: a Bitcoin-derived UTXO chain and an EVM-compatible NEVM chain, joined by a cross-chain bridge. The bridge's NEVM side mints SYS in response to cross-chain messages that are supposed to be proven against the UTXO chain via an SPV (simplified payment verification) / Merkle proof — i.e., a mint on NEVM should only follow a corresponding burn/lock that the proof attests to.

On 2026-06-07, an attacker submitted a cross-chain message carrying a malformed proof structured specifically to be misinterpreted by the bridge's proof-parsing code. The parser read the invalid data as a legitimate proof, the verification predicate passed, and the bridge minted ~5,000,000,000 SYS on NEVM with no corresponding burn on the UTXO side. At prevailing prices the minted supply was worth roughly $8.56M–$10M.

Syscoin detected the anomaly and paused the bridge within hours, publishing a measured preliminary post-mortem the same evening that named the flaw, the three transaction hashes (mint / spend / split), and the two tainted wallets. The team coordinated with exchanges and partners to freeze the minted SYS and offered a recovery address with a white-hat bounty. The attacker returned the funds through two on-chain transactions, leaving the realised loss at ~$0 against the ~5B-SYS notional mint. Halborn published the substantive technical breakdown the following morning, classifying the root cause as an SPV-proof-parsing flaw and drawing the explicit comparison to the 2022 Nomad Bridge hack.

Timeline (UTC)

When Event OAK ref
Pre-2026-06-07 Syscoin bridge mints SYS on NEVM against SPV/Merkle proofs of UTXO-side burns; the proof-parsing path admits malformed input (standing T10.002 surface)
2026-06-07 Attacker submits a malformed proof structured to be misread as valid; the NEVM bridge accepts it and mints ~5B SYS with no UTXO-side burn (a5b422ab…fa184) T10.002 execution
2026-06-07 Attacker spends/splits the minted SYS across wallets (ba6798fa…d5ff4, 31e12b0d…117113c); ~4B + ~1B held in two addresses (laundering attempt)
2026-06-07 (evening) Syscoin pauses the bridge; publishes preliminary post-mortem naming the flaw, tx hashes, and tainted wallets; coordinates exchange freezes (operator response)
2026-06-08 (morning) Halborn publishes technical breakdown: SPV-proof-parsing flaw, Nomad-2022 comparison (third-party forensics)
2026-06 Recovery address + white-hat bounty offered; funds returned via two transactions; realised loss ~$0 (recovery)

What defenders observed

  • Pre-event (parser not fuzzed against adversarial input). The exposure lived in the proof-parsing code, not the proof-validation logic — a class of bug that a verification-focused audit can miss if it assumes well-formed proofs. Defender lesson: fuzz the proof deserialiser with malformed/adversarial inputs; separate "parses" from "is valid" as two invariants (OAK-M16 pre-deployment audit + formal verification, with explicit attention to deserialisation).
  • At-event (mint-without-burn). The direct exploitation signature is a NEVM mint with no corresponding UTXO-side burn — the canonical T10.002 "release from locked side without lock" indicator. A real-time invariant that every bridge mint must reconcile to a confirmed source-chain burn would have fired immediately and is the highest-leverage runtime control for this class.
  • At-event (implausible supply delta). ~5B SYS minted in a single event is implausibly large relative to normal bridge throughput; a supply/throughput anomaly monitor on the NEVM side is a confirmation-grade signal.
  • Post-event (fast containment). Syscoin's pause-within-hours + exchange-coordinated freeze + recovery-address bounty converted a ~$10M notional mint into ~$0 realised loss. The transparent same-evening post-mortem (named flaw, published tx hashes and addresses) is a reference example of disclosure that aids — rather than obstructs — recovery.

Public references

Discussion

Syscoin is the cleanest 2026 addition to OAK's T10.002 family because it isolates a sub-shape the prior anchors did not: the failure is neither a mis-initialised trusted root (Nomad), nor a missing field-level check (Wormhole guardian account; Verus source amount), nor an encoding ambiguity in the message hash (MAP Protocol abi.encodePacked), but a proof-parser that can be coaxed into reading invalid bytes as a valid proof. The cryptographic verification was, in a narrow sense, intact — the attacker never produced a genuinely valid proof — yet the bridge minted from nothing because the bytes never reached the cryptographic check in the form the check assumed. This makes Syscoin the canonical reference for the lesson that proof parsing is part of the verification attack surface, and that bridge audits must fuzz the deserialiser, not only reason about the validity predicate.

The case also restates the T10.002 "mint-without-source-event" detection invariant in UTXO ⇄ EVM form: the highest-leverage runtime control is reconciliation that every NEVM mint maps to a confirmed UTXO-side burn. And it is a positive containment reference — the realised loss was ~$0 not because the mint was small (~5B SYS, ~$10M notional) but because the team paused fast, froze via exchanges, and the attacker took the white-hat exit. Contributors writing future T10.002 examples should record the parsing-vs-validation distinction explicitly and continue logging both notional and realised loss, since the gap (here ~$10M vs ~$0) is the structural signal the class is defined by.

Techniques demonstrated (1)