Cysic Bridge Attacker Sends $744,000 in Ether to Tornado Cash

Update 18:44 UTC: Initia, a layer-1 network built around interconnected rollups known as Minitias, halted its blockchain and rollups at 3:41 p.m. UTC the same day after security researchers flagged an exploit in which an attacker minted tokens without authorization and drained more than $2.6 million.

300 ETH Routed to Tornado Cash

The wallet behind the Cysic bridge exploit moved roughly $744,000 in cryptocurrency into Tornado Cash on Friday, according to an on-chain alert from blockchain security firm PeckShield. The transfers totaled 300 Ethereum (ETH) and 30.4 BNB, and they reached the mixer a day after the Cysic Foundation publicly offered the attacker a 10% recovery bounty. What the chain documents is the movement itself; whether the hacker saw that offer before laundering the funds is something neither the foundation nor the security firm has established.

The trail starts earlier in the week. A bridge protocol connects two blockchains so assets can move between them, and on Saturday an attacker used a flaw in this bridge's smart contract to mint 10 million CYS, the project's native token, on BNB Smart Chain. Cysic's containment came fast: the team suspended the bridge and blacklisted the recipient's address, freezing roughly 2.8 million of the minted supply before it could move. The foundation stated at the time that its mainnet and the assets already held in user wallets were unaffected, which confined the breach to the bridge itself and the newly issued tokens. Friday's transfers then showed which leg of the theft stayed out of the team's reach: freezing supply on its own chain was technically straightforward, but the Ether proceeds had sat in an attacker-controlled wallet from the first block, beyond the effect of any blacklist.

Onchain Lens, a blockchain analysis platform, added granularity to the laundering picture in an Oct. 23 post on X, tracing how the proceeds were built. The attacker sold roughly 7.2 million of the 10 million minted CYS before the team's blacklist landed 76 minutes after the Oct. 17 exploit, which hit at 12:31 UTC: an initial 5.65 million CYS went for about 588,315 USDT, and another 1.55 million CYS was converted into roughly 220 BNB. Cross-chain services Mayan, deBridge and SWFT's Bridgers then moved about 306.6 Ethereum (ETH) to Ethereum, a figure that lines up with the 300 ETH later sent to the mixer. Cysic has hired an independent security firm for the review and has not set a date for reopening the bridge, and the $744,000 figure should not be read as its confirmed total loss.

The pattern was not unique to Cysic on Friday. Initia, a layer-1 network built around interconnected rollups known as Minitias, halted its blockchain and rollups at 3:41 p.m. UTC the same day after security researchers flagged an exploit in which an attacker minted tokens without authorization and drained more than $2.6 million. DeFi platform D2 Finance reported that a flaw in a Move function let the attacker mint 2 million AUSD tokens without sufficient backing, then bridge roughly 1.4 million AUSD, 105 ETH and 1.08 million USDC to Ethereum, consolidating the take into a wallet holding about 1,135.5 ETH, worth $2.73 million. Initia said it was working with security researchers, validators and exchanges to assess the damage, though it has not confirmed the losses or the cause. Its INIT token briefly fell to around $0.115 before rebounding near $0.15.

A 10% Bounty, Answered by a Mixer

The bounty terms went public on Thursday, when the Cysic Foundation posted that it would let the attacker keep 10% of the take if the remaining 275.872 Ethereum (ETH) came back, a sum worth about $665,000 when the offer was published and roughly 90% of the Ether proceeds the team had identified on-chain. Offering a hacker a slice of stolen funds is an established, if inconsistent, playbook among exploited projects, and the foundation modeled its terms on that kind of bounty program without setting a deadline. The attacker's answer arrived within about 24 hours, and it was not a negotiation: instead of returning anything, the wallet pushed 300 ETH and 30.4 BNB into Tornado Cash, although the terms had named only Ether.

The destination matters for the recovery math. Tornado Cash pools deposits from many addresses into shared balances, so funds broken up inside its pools stop being attributable to a single origin in any practical sense. On-chain data showed the attacker's Ethereum wallet holding just $45 in ETH after the Friday transfers, an amount barely above the gas fee needed for another move and leaving almost nothing in place for the foundation or anyone else to seize. Between the exploit and the bounty, the foundation's disclosed containment ran to the suspension, the blacklist and the frozen 2.8 million CYS, and the 10% offer was the only recovery step it named. The foundation had not responded to a request for comment on the recovery effort at the time of writing.

Our reading of the on-chain sequence: the arithmetic in the foundation's own offer marks the boundary of what it controlled. Asking for 275.872 ETH as 90% of identified proceeds implies a total Ether haul near 307, and none of the BNB was ever covered by the terms. Freezing 2.8 million CYS capped the damage on BNB Smart Chain at the token layer, but the attacker's reply, mixing the full hoard within roughly a day of the bounty going live, reads as a refusal rather than silence awaiting a better deal, though the foundation has not said whether it still expects contact. What is documented is $744,000 entering Tornado Cash and a wallet left with $45; what nobody has established is whether any portion comes back.