TL;DR
- The hacker behind the Cysic exploit transferred approximately $744,000 in ETH and BNB to Tornado Cash after receiving an offer to return the stolen funds.
- The Cysic Foundation had offered a 10% bounty in exchange for recovering approximately 275.87 ETH, worth $665,000.
- The attack allowed 10 million CYS tokens to be minted without authorization on BNB Smart Chain. The company froze approximately 2.8 million of those tokens.
The hacker behind the Cysic bridge exploit transferred approximately $744,000 in cryptocurrency to Tornado Cash after the protocol offered a 10% bounty to recover the stolen funds.
According to blockchain security firm PeckShield, the address linked to the attacker sent 300 ETH and 30.4 BNB to the cryptocurrency mixer. Tornado Cash pools deposits from different addresses, making it more difficult to trace the funds afterward.
The transfers were detected after Cysic proposed that the attacker return most of the funds in exchange for keeping a portion as a reward. The transfer to Tornado Cash suggests that the attacker did not accept the offer on those terms.
#PeckShieldAlert The address labeled as the @cysic_xyz exploiter has deposited 300 $ETH (~$721.14K) and 30.4 $BNB (~$22.59K) into #TornadoCash.
On October 17, the Cysic cross-chain bridge suffered a security incident, with 10M base:0x19e8d59ff3d7a31289e0dc04db48d43b02c7ffa6… pic.twitter.com/cjgeimVnex
— PeckShieldAlert (@PeckShieldAlert) October 23, 2026
Cysic Offered a 10% Bounty to Recover the Funds
The Cysic Foundation proposed that the attacker return 275.872 ETH, worth approximately $665,000, representing roughly 90% of the Ether proceeds identified following the exploit.
Under the offer, the attacker would be allowed to keep the remaining 10% as an incentive to return the assets.
However, the transactions identified by PeckShield show that the attacker instead transferred the funds to the mixer. According to Arkham data cited in the report, the attacker’s Ethereum address held just $45 in ETH after the transfers.
The foundation has not announced any recovery agreement or issued further comments on the matter.
Hacker Minted 10 Million CYS Tokens
The incident began when the hacker exploited a vulnerability in Cysic’s bridge to mint 10 million CYS tokens without authorization on BNB Smart Chain.
After detecting the unauthorized minting, the project suspended the bridge and blacklisted the receiving address. These measures allowed it to freeze approximately 2.8 million of the newly minted tokens.
The protocol stated that its mainnet and assets already held in users’ wallets were not affected by the vulnerability.
Although some of the tokens were frozen, the funds converted into ETH and BNB remained under the attacker’s control and were subsequently transferred to Tornado Cash.
