A wallet linked to the Cysic bridge exploit has moved roughly $744,000 in Ether and BNB into Tornado Cash, complicating recovery efforts shortly after the Cysic Foundation offered a 10% bounty for returning most of the identified proceeds.
According to blockchain security firm PeckShield, the attacker-linked address deposited 300 ETH, worth about $721,100, and 30.4 BNB, worth about $22,600, into Tornado Cash on October 23. The combined transfers totaled approximately $743,700. Tornado Cash pools deposits from different addresses, making subsequent on-chain tracing substantially more difficult, though the movement alone does not prove the funds were sold or converted to fiat.
The original incident occurred on October 17, when an attacker exploited a vulnerability in Cysic’s cross-chain bridge to mint 10 million CYS tokens without authorization on BNB Smart Chain. That amount equals 1% of the token’s one-billion-token total supply. Cysic suspended the bridge and blacklisted the receiving address about 76 minutes after the unauthorized mint, freezing approximately 2.8 million CYS. The remaining roughly 7.2 million tokens had already been moved elsewhere.
Cysic said its mainnet and existing user assets were not compromised, and the vulnerability was linked to infrastructure supporting the cross-chain bridge and the message-processing used to authorize minting.
Before the Tornado Cash transfers, the Cysic Foundation proposed that the attacker return 275.872 ETH, worth about $665,000, while keeping 30.652 ETH as a 10% bounty. The foundation attached a 72-hour period to the settlement offer and said it would continue pursuing the incident if the funds were not returned. Because the deposits occurred before that full window had necessarily expired, the transfers should not automatically be described as a formal rejection of the bounty, though they clearly weaken recovery prospects.
Arkham data cited in reports indicated the attacker’s Ethereum address held just $45 in ETH after the transfers. The Cysic Foundation has not announced any recovery agreement or issued further comments.
The movement does not represent a new exploit or an additional loss. Instead, it shows that assets attributed to the original attack are now being routed through privacy infrastructure. Analysts note that similar situations have produced mixed outcomes: in May, the Verus bridge attacker returned 4,052 ETH after accepting a negotiated bounty, while funds linked to the Drift Protocol attacker were also sent into Tornado Cash, reducing transparency for victims and investigators.
Going forward, Cysic investors are watching for a complete reconciliation of the exploit, including how many unauthorized tokens were sold, what value was extracted, whether any additional attacker-linked wallets retain proceeds, and whether the bridge vulnerability has been fully remediated before cross-chain operations resume.
