Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash

Cysic’s bridge was exploited, allowing an attacker to create 10 million CYS tokens on BNB Smart Chain without authorization. The incident mattered because the attacker could convert a bridge weakness into newly created tokens and cryptocurrency proceeds. Cysic suspended the bridge and blacklisted the recipient address.

The attacker later moved about $744,000 in cryptocurrency to Tornado Cash, a mixer. PeckShield identified transfers of 300 ETH and 30.4 BNB. Cysic froze about 2.8 million of the newly minted CYS tokens, while the foundation said its mainnet and users’ existing assets were unaffected.

The foundation offered a recovery bounty, but the attacker still sent the identified cryptocurrency to Tornado Cash. The Ethereum wallet held only $45 in ETH at press time, according to Arkham data. The transfer made recovery and tracking more difficult, while Cysic continued efforts to recover funds.

A crypto bridge is a system that helps move value or token representations between separate blockchains. It matters because blockchains normally keep separate records, so users need a mechanism to represent an asset on another network. Bridges often rely on contracts, validators, or other checks to confirm that assets were deposited or locked.

A vulnerability can break those checks. In Cysic’s case, the attacker exploited the bridge and minted 10 million CYS tokens on BNB Smart Chain. The newly created tokens were not described as coming from a legitimate transfer. Cysic suspended the bridge and blacklisted the recipient address, freezing about 2.8 million tokens.

This shows why bridge security is important. A flawed bridge can approve or create tokens without the intended backing or authorization. The article says Cysic’s mainnet and existing assets in user wallets were unaffected, but the attacker still obtained a large supply of newly minted tokens.

The attack had two main measurements: the number of unauthorized tokens created and the cryptocurrency moved afterward. The attacker minted 10 million CYS tokens on BNB Smart Chain. This represented a major supply creation through the exploited bridge, although the article does not give a dollar value for all the minted CYS.

The attacker also transferred about $744,000 in cryptocurrency to Tornado Cash. PeckShield reported that the transfer consisted of 300 ETH and 30.4 BNB. Separately, Cysic blacklisted the recipient address and froze about 2.8 million of the newly minted CYS tokens.

That means the frozen amount was only part of the 10 million-token creation. The article does not state how much of the remaining CYS was sold or moved. It does say the foundation’s mainnet and existing assets in user wallets were unaffected, limiting the reported impact on those assets.

The Cysic Foundation responded first with technical controls. It suspended the bridge and blacklisted the recipient address, freezing about 2.8 million of the 10 million newly minted CYS tokens. The foundation also said its mainnet and existing assets in users’ wallets were unaffected.

The following Thursday, it offered the attacker a 10% recovery bounty. In exchange, the attacker was asked to return 275.872 ETH, valued at about $665,000. That amount represented roughly 90% of the identified Ether proceeds. The offer was designed to recover most of the traceable cryptocurrency while giving the attacker a financial incentive to cooperate.

The response did not immediately produce a return of funds. On Friday, the wallet linked to the exploit sent about $744,000 in ETH and BNB to Tornado Cash. Cysic later did not respond to Cointelegraph’s request for comment on recovery efforts.

Tornado Cash is a cryptocurrency mixer. It pools deposits from multiple addresses before funds are withdrawn. The article highlights its central effect: combining deposits makes the money’s path harder to follow. This matters during an investigation because investigators may no longer see one clear route from the original wallet to a final recipient.

In the Cysic incident, the attacker’s wallet sent 300 ETH and 30.4 BNB to Tornado Cash. PeckShield valued the transferred cryptocurrency at about $744,000. The mixer did not erase the original blockchain transactions, but it added other deposits and withdrawals around them, complicating attribution.

The article reports that the attacker’s Ethereum wallet held only $45 in ETH at press time, according to Arkham data. Cysic had offered a 10% recovery bounty before the transfer. Once the funds entered the mixer, recovery efforts faced a more difficult tracing problem, and the foundation did not provide Cointelegraph with a comment.

Blockchain transactions remain publicly recorded, so sending funds to a mixer does not erase evidence of the transfer. However, the visible record becomes harder to interpret. A mixer combines deposits from many addresses, which can obscure which later withdrawal belongs to which original deposit. That weakens the simple link investigators would otherwise follow.

Here, the exploit-linked wallet sent 300 ETH and 30.4 BNB, worth about $744,000, to Tornado Cash. The service pooled those deposits with funds from other addresses. The attacker’s Ethereum wallet then held only $45 in ETH at press time, according to Arkham data. That balance did not reveal where the transferred funds ultimately went.

Recovery therefore becomes more difficult, not necessarily impossible. Investigators can still examine the public records, timing, amounts, and related addresses, but the mixer creates more possible paths. The article gives no confirmed recovery result. Cysic had offered a 10% bounty, while the foundation did not comment on recovery efforts.

Blockchain tokens are digital assets recorded and transferred on a blockchain. CYS is the token involved in the Cysic incident, while ETH and BNB are cryptocurrencies used in the reported transfers. Each blockchain maintains its own records, so an asset or token on one network is not automatically the same as an asset on another network.

A bridge is meant to coordinate those separate networks. It may lock or track assets on one chain and issue a corresponding representation on another. If the bridge’s authorization logic fails, someone may mint that representation without a valid deposit or matching underlying asset. In this case, the attacker minted 10 million CYS tokens on BNB Smart Chain through a bridge exploit.

The newly minted CYS therefore did not automatically represent legitimate value held elsewhere. The article does not describe the bridge’s exact technical design, but it confirms that the exploit enabled unauthorized minting. Cysic froze about 2.8 million tokens and said its mainnet and existing user assets were unaffected.