Wallets labeled as belonging to the Cysic bridge exploiter deposited approximately 300 ETH and 30.4 BNB into Tornado Cash on Friday, according to blockchain analytics firm PeckShield. The deposits amount to roughly $721,140 in ether and $22,590 in BNB, or about $744,000 in total. The movement came just days after the Cysic Foundation publicly offered a 10% bounty for the return of most of the identified ETH proceeds from the exploit.

PeckShield Tracks the Mixer Deposits

PeckShield's October 23 alert, posted on X, named an address labeled as the Cysic (@cysic_xyz) exploiter as the source of the Tornado Cash deposits. The firm also restated the underlying incident of October 17, in which attackers minted 10 million CYS without authorization on BNB Chain, as the Cysic Foundation described.

Tornado Cash commingles deposits from many users. Once funds sit in the pool, later withdrawals become harder to tie to any specific deposit, though off-chain clues can still matter. The mixer has been through its own years-long regulatory saga — OFAC sanctioned it in August 2022, a U.S. appeals court ruled in late 2024 that its immutable smart contracts are not sanctionable property, and Treasury lifted those sanctions in March 2025 — yet its appearance in PeckShield's alert shows it remains a routine marker in how analytics firms trace stolen funds. For observers of crypto crime flows, Friday's transfers are a familiar second act after a bridge mint: convert, move, then obscure.

The Bridge Mint Reported on October 17

In itsincident report](https://x.com/cysic_fdn/status/2111761749116637687), the Cysic Foundation said the cross-chain bridge was attacked on October 17, 2026. An attacker minted 10,000,000 CYS on BNB Smart Chain at 12:31:38 UTC without authorization. According to Cysic, the attacker gained unauthorized access to a database that supported the bridge, and a flaw in processing logic then allowed a fraudulent mint message through. The foundation added that the full attack path was still under investigation.

That combination is why bridges keep drawing attackers: they concentrate pooled assets on both sides of a chain boundary and rely on message-verification logic to approve transfers, so compromised infrastructure combined with a weak check can turn a fake message into freshly minted value.

Cysic framed the event as limited to bridge message processing and minting. It said existing user assets held in wallets were not stolen and that the Cysic mainnet was not affected. The bridge was suspended as a containment measure, and cross-chain service through it remained closed while security reviews were underway.

The foundation published the mint recipient address as 0xA4e1827Fe2664fD0797a55e442b2e2639449C255 and the mint transaction on BNB Smart Chain as 0x8de43ba77f9a14ecff1268acb9d7c9bf3afe1f2a45bd8d8681d824a2460000f6. At 13:47:52 UTC the same day, Cysic said the address had been blacklisted in the CYS token contract on BNB Smart Chain, restricting transfers of roughly 2.8 million CYS still sitting there. The project also stressed that the raw mint size was not, by itself, the final dollar loss.

On October 19, the foundation said all relayers remained paused, that deposited CYS in the bridge contracts stayed secure, and that the bridge would reopen only once security checks were finished.

The 10% Bounty and the 72-Hour Clock

On October 22, the Cysic Foundation posted a direct offer to the party behind the exploit: an approximate 10% bounty in exchange for the return of about 90% of the identified ETH proceeds from the unauthorized CYS mint. The terms were precise. The actor was asked to send 275.872 ETH on Ethereum mainnet to a Foundation-controlled address, 0xe3e8E1147a47dCf42fa73892D74928544fe5a6A9.

If that amount arrived within a 72-hour window beginning with the on-chain publication of the message, the actor could keep about 30.652 ETH as the bounty. Cysic said it would publicly acknowledge the cooperation and treat its ETH claim under the offer as resolved. If the funds were not returned by the deadline, the foundation said it would escalate the matter to law enforcement for a full criminal investigation. Cysic published the same terms as on-chain messages on both BNB Chain and Ethereum, and the project account @cysic_xyz amplified the offer the same day.

As published, that clock runs through October 25 — meaning Friday's mixer deposits surfaced inside the window, not after the deadline.

Why the Mixer Move Matters

A posted bounty is, in effect, a negotiation. A mixer deposit is an exit. With the offer, Cysic followed the white-hat script many protocols use after a bridge failure: name a return address, price a keep-back fee, set a clock, and threaten prosecution. PeckShield's Friday alert instead shows labeled proceeds flowing into Tornado Cash.

That does not prove every dollar from the exploit is gone forever. It does show the funds shifting into a tool built to break easy wallet-to-wallet tracing. Bridge mints and mixer deposits sit on the same map as other crypto hacks, which turn protocol bugs into portable assets — Ronin in March 2022, Wormhole in February 2022, and BNB Bridge in October 2022 each saw nine-figure bridge drains. The Cysic case is also a reminder that the first headline is usually the exploit itself, while the quieter story is where the coins go next. The next checkpoints are on-chain: whether the demanded 275.872 ETH reaches the Foundation's address by the deadline, whether Cysic carries out its stated escalation to law enforcement if it does not, and whether the suspended bridge reopens once its security checks conclude. The technology behind theft keeps changing, while the underlying psychology — offering a cut for return, then watching whether the other side takes the deal or reaches for a darker pool — remains much the same.