Cysic bridge hacker sends $744,000 to Tornado Cash after 10% bounty offer

23 Oct 2026

23 Oct 2026, 13:08 UTC+02:00

The attacker behind last weekend’s Cysic bridge exploit has started laundering the proceeds. The linked wallet sent about $744,000 in crypto to the Tornado Cash mixer on Friday, shortly after the Cysic Foundation offered a 10% bounty for the return of the funds, Cointelegraph reported.

What happened to the funds

According to blockchain security company PeckShield, the address transferred 300 Ether (ETH) and 30.4 BNB to Tornado Cash. The mixer pools deposits from many addresses, which makes the money much harder to follow on-chain. By press time, the attacker’s Ethereum wallet held just $45 in ETH, according to Arkham data cited in the report.

How the exploit worked

On Saturday, the hacker abused a vulnerability in Cysic’s bridge to mint 10 million Cysic (CYS) tokens on BNB Smart Chain. Cysic responded by suspending the bridge and blacklisting the recipient address, which froze about 2.8 million of the newly minted tokens. The foundation said its mainnet and the assets already sitting in user wallets were not affected.

The remaining tokens appear to have been converted, since the attacker later held ETH and BNB proceeds that are now moving through the mixer.

The bounty offer

On Thursday, the Cysic Foundation offered the attacker a 10% white hat bounty in exchange for returning 275.872 ETH, worth about $665,000. That figure represents roughly 90% of the Ether proceeds the foundation had identified. Sending funds to Tornado Cash the next day suggests the offer has, at least so far, not been accepted. Cointelegraph said it asked the Cysic Foundation for comment on recovery efforts but did not get a reply before publication.

What it means for traders

• Bridges remain a weak point. This exploit did not touch Cysic’s mainnet, but a flaw in the bridge was enough to mint millions of unbacked tokens. Before you bridge assets between chains, check whether the bridge has had incidents and keep only what you need on the far side.
• Unbacked mints can hit token prices. When an attacker creates tokens out of thin air and sells them, holders of that token can take the loss even if their own wallets were never touched. If you hold or trade a token after an exploit, follow official project channels for updates on frozen supply and bridge status before adding to a position.
• Mixing usually means slow or no recovery. Once stolen funds go through a mixer, recovery gets much harder. Treat any bounty offer as a hope, not a plan, when sizing exposure to an affected project.
• Pick venues with clear security practices. Centralized exchanges also handle bridged and newly listed tokens, so incident response and custody matter. We look at this in our testing method, and you can compare platforms such as BingX, OKX and Kraken in our exchange comparison.

Related reviews

• Bingx review
• Okx review
• Kraken review

Sources

• Cointelegraph: Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash

News is for information only and is not financial advice. More crypto news