Cysic Bridge Exploiter Sends $744K in ETH and BNB to Tornado Cash After 10% Bounty Offer
Key Takeaways
- •The exploiter's wallet transferred 300 ETH and 30.4 BNB, valued at roughly $744,000, to Tornado Cash on Friday, according to PeckShield.
- •The hacker exploited a vulnerability in Cysic's bridge on Saturday to mint 10 million CYS tokens on BNB Smart Chain.
- •Cysic suspended the bridge and blacklisted the recipient address, freezing about 2.8 million of the newly minted tokens, while its mainnet and user-held assets were unaffected.
- •Before the funds were routed through the mixer, the Cysic Foundation publicly offered a 10% bounty for the return of 275.872 ETH, worth about $665,000, or roughly 90% of the identified Ether proceeds.
- •Tornado Cash obscures links between deposit and withdrawal addresses, and the attacker's Ethereum wallet held just $45 in ETH at press time, complicating prospects for fund recovery.
The wallet linked to the Cysic bridge exploit has sent roughly $744,000 in cryptocurrency to Tornado Cash, days after the Cysic Foundation offered the attacker a 10% recovery bounty in exchange for returning the stolen funds.
According to blockchain security company PeckShield, the address transferred 300 Ether (ETH) and 30.4 BNB to the crypto mixer on Friday.
How the exploit unfolded
The incident began on Saturday, when the hacker exploited a vulnerability in Cysic's bridge to mint 10 million Cysic (CYS) tokens on BNB Smart Chain. Cysic suspended the bridge and blacklisted the recipient address, freezing about 2.8 million of the newly minted tokens. The foundation said its mainnet and the existing assets held in user wallets were unaffected.
Cross-chain bridges have been a recurring weak point for the industry: the protocols, which let tokens move between blockchains and typically hold large pools of locked assets, featured in some of crypto's largest hacks, including the Ronin and Wormhole exploits of 2022 that drained hundreds of millions of dollars combined.
The following Thursday, the Cysic Foundation publicly offered the hacker a 10% bounty in exchange for returning 275.872 ETH, worth about $665,000, representing roughly 90% of the identified Ether proceeds.
Funds pushed through mixer
Tornado Cash pools deposits from multiple addresses, making the funds harder to trace and complicating efforts to recover them. The attacker's Ethereum wallet held just $45 in ETH at press time, according to Arkham data.
Tornado Cash is a decentralized crypto mixing service designed to obscure the connection between deposit and withdrawal addresses. The protocol was sanctioned by the United States Treasury's Office of Foreign Assets Control in August 2022, though those sanctions were lifted in March 2025 after a federal appeals court ruled the Treasury had exceeded its authority.
Cointelegraph contacted the Cysic Foundation for comment on fund recovery efforts but did not receive a response by publication. It remains to be seen whether the foundation pursues additional recovery measures now that the funds have passed through the mixer.
