Cysic Bridge Attacker Sends $744,000 in Ether to Tornado Cash

300 ETH Routed to Tornado Cash

The wallet behind the Cysic bridge exploit moved roughly $744,000 in cryptocurrency into Tornado Cash on Friday, according to an on-chain alert from blockchain security firm PeckShield. The transfers totaled 300 Ethereum (ETH) and 30.4 BNB, and they reached the mixer a day after the Cysic Foundation publicly offered the attacker a 10% recovery bounty. What the chain documents is the movement itself; whether the hacker saw that offer before laundering the funds is something neither the foundation nor the security firm has established.

The trail starts earlier in the week. A bridge protocol connects two blockchains so assets can move between them, and on Saturday an attacker used a flaw in this bridge's smart contract to mint 10 million CYS, the project's native token, on BNB Smart Chain. Cysic's containment came fast: the team suspended the bridge and blacklisted the recipient's address, freezing roughly 2.8 million of the minted supply before it could move. The foundation stated at the time that its mainnet and the assets already held in user wallets were unaffected, which confined the breach to the bridge itself and the newly issued tokens. Friday's transfers then showed which leg of the theft stayed out of the team's reach: freezing supply on its own chain was technically straightforward, but the Ether proceeds had sat in an attacker-controlled wallet from the first block, beyond the effect of any blacklist.

A 10% Bounty, Answered by a Mixer

The bounty terms went public on Thursday, when the Cysic Foundation posted that it would let the attacker keep 10% of the take if the remaining 275.872 Ethereum (ETH) came back, a sum worth about $665,000 when the offer was published and roughly 90% of the Ether proceeds the team had identified on-chain. Offering a hacker a slice of stolen funds is an established, if inconsistent, playbook among exploited projects, and the foundation modeled its terms on that kind of bounty program without setting a deadline. The attacker's answer arrived within about 24 hours, and it was not a negotiation: instead of returning anything, the wallet pushed 300 ETH and 30.4 BNB into Tornado Cash, although the terms had named only Ether.

The destination matters for the recovery math. Tornado Cash pools deposits from many addresses into shared balances, so funds broken up inside its pools stop being attributable to a single origin in any practical sense. On-chain data showed the attacker's Ethereum wallet holding just $45 in ETH after the Friday transfers, an amount barely above the gas fee needed for another move and leaving almost nothing in place for the foundation or anyone else to seize. Between the exploit and the bounty, the foundation's disclosed containment ran to the suspension, the blacklist and the frozen 2.8 million CYS, and the 10% offer was the only recovery step it named. The foundation had not responded to a request for comment on the recovery effort at the time of writing.

Our reading of the on-chain sequence: the arithmetic in the foundation's own offer marks the boundary of what it controlled. Asking for 275.872 Ethereum (ETH) as 90% of identified proceeds implies a total Ether haul near 307, and none of the BNB was ever covered by the terms. Freezing 2.8 million CYS capped the damage on BNB Smart Chain at the token layer, but the attacker's reply, mixing the full hoard within roughly a day of the bounty going live, reads as a refusal rather than silence awaiting a better deal, though the foundation has not said whether it still expects contact. What is documented is $744,000 entering Tornado Cash and a wallet left with $45; what nobody has established is whether any portion comes back.