Cysic Bridge Hacker Dumps $744K Into Tornado Cash After Rejecting 10% Bounty
A hacker who exploited Cysic's BNB Smart Chain bridge to mint 10 million unauthorized CYS tokens rejected the foundation's 10% recovery bounty and routed approximately $744,000 in ETH and BNB through Tornado Cash on October 23, per PeckShield.
The attacker had a 76-minute head start to drain $727K before Cysic could act. The bounty offer didn't matter.
Key takeaways
- A hacker exploited a flaw in Cysic's cross-chain bridge on October 17 to mint 10 million unauthorized CYS tokens, selling 7.2 million within minutes and moving approximately $727,000 in ETH to Ethereum before Cysic blacklisted the recipient address 76 minutes later.
- Cysic Foundation offered a 10% bounty on October 22, asking the attacker to return 275.872 ETH and keep 30.652 ETH (~$73,000 at then-current prices). The attacker responded by sending 300 ETH and 30.4 BNB (approximately $744,000 combined) into Tornado Cash on October 23, per PeckShield.
- Cross-chain bridges stack database access, message-processing logic, and minting permissions into a single attack surface. Once funds clear through a mixer, the "bounty + law enforcement" playbook has almost no historical precedent for recovery.
The hacker who exploited Cysic's BNB Smart Chain bridge to mint 10 million CYS tokens out of thin air rejected the project's structured recovery offer and routed approximately $744,000 through Tornado Cash on October 23, according to blockchain security firm PeckShield (@PeckShieldAlert). The bounty negotiation is over. The funds are almost certainly gone.
Cysic Foundation (@cysic_fdn) disclosed the original breach on October 18, explaining that an attacker gained unauthorized access to a database supporting the bridge, then submitted a forged mint message at 12:31:38 UTC on October 17. The attacker sold 7.2 million of the 10 million newly minted tokens within approximately five minutes and moved the proceeds to Ethereum. By 13:11 UTC, approximately $727,000 had reached a second ETH wallet.
Cysic suspended the bridge and blacklisted the recipient BNB address at 13:47:52 UTC, freezing roughly 2.8 million tokens. The foundation confirmed that its mainnet and existing user wallet assets were unaffected.
On October 22, Cysic Foundation published an on-chain settlement offer: return 275.872 ETH (approximately 90% of the identified proceeds) and keep 30.652 ETH as a white-hat bounty. The attacker's answer was 300 ETH and 30.4 BNB deposited into Tornado Cash. Per Arkham Intelligence data cited in the first reporting by Cointelegraph, the attacker's ETH wallet held approximately $45 at press time, a point-in-time figure.
The 76-Minute Window Is the Whole Problem
The bounty offer was always theater. The attacker had liquidated 7.2 million tokens and cleared $727,000 to Ethereum before Cysic's team could execute a single defensive action. That's not a slow response. Bridges have no "undo." There is no on-chain rollback, no freeze function that reaches across chains in real time.
The math on the bounty offer is worth noting. By proposing to let the attacker keep 30.652 ETH (~$73,000), the foundation effectively put a public price tag on the vulnerability: this exploit was worth roughly $73,000 of the attacker's time. The other $665,000 is now a charitable donation, post-Tornado Cash.
The attack surface here was not exotic. A database breach plus a forged message in a bridge's minting logic was sufficient to print 10 million tokens and drain most of them before anyone responded. Every cross-chain bridge layers these components together: a database, a message-passing layer, and minting permissions, each one an additional entry point.
The DPRK's Tornado Cash activity has proven repeatedly that mixers absorb nine-figure sums without meaningful impediment. Approximately $744,000 is noise by comparison.
Tornado Cash is also still running. Despite the OFAC sanctions saga and years of "regulators will fix this" assurances, the mixer absorbed another approximately $744,000 in stolen funds with no friction. That's relevant context for anyone who thinks regulatory pressure has solved the problem.
The native Bitcoin stack has none of this attack surface at the protocol level. Wrapping Bitcoin onto BNB Chain or any other network reintroduces exactly the counterparty and technical risk that self-custody on the base layer eliminates. The FinCEN self-custody rules debate is often framed as a privacy argument. It's also a security argument: every intermediary between a holder and their coins is another Cysic bridge waiting to happen.
What to Watch
Cysic's 72-hour bounty deadline ran from October 22, meaning it likely expired around October 25. The foundation said it would involve law enforcement if the deadline passed without a return. Post-Tornado Cash recovery has almost no historical precedent at this scale, and Cysic has not responded to requests for comment on next steps. Watch whether on-chain forensics firms can trace any residual flows after the mixer, and whether any exchange compliance teams flag wallet clusters on the receiving end.
Sources
- Cysic Foundation (@cysic_fdn) incident report, X, October 18, 2026
- Cysic Foundation (@cysic_fdn) bounty/settlement offer, X, October 22, 2026
- PeckShield (@PeckShieldAlert), Tornado Cash alert, X, October 23, 2026
- Arkham Intelligence (on-chain wallet data)
- First reported by Cointelegraph (Zoltan Vardai, October 23, 2026)
Frequently Asked Questions
What is Tornado Cash and why do attackers use it?
Tornado Cash is an Ethereum-based mixing protocol that pools deposits from multiple wallets and breaks the on-chain link between sender and recipient. Funds deposited into the mixer lose their traceable provenance, making post-transfer recovery or freeze actions extremely difficult for both private parties and law enforcement.
Can the stolen funds be recovered after going through Tornado Cash?
Almost certainly not. Recovery after a mixer at this scale has almost no historical precedent. Cysic stated it preserved technical and on-chain evidence and would involve law enforcement if the bounty window closed without a return, but the combination of a pseudonymous attacker and Tornado Cash routing makes meaningful recovery unlikely.
Does this affect holders of native Bitcoin?
No. Bridge and minting exploits are specific to cross-chain infrastructure built on top of programmable token systems. Native Bitcoin held in self-custody has no bridge database, no cross-chain minting logic, and no equivalent attack surface at the protocol level. The risk only applies to wrapped or bridged representations of assets on other networks.
