Cysic Exploiter Sends $744K to Tornado Cash After Bounty

A white-hat window opened with a 10% bounty. The next move was a mixer deposit.

Wallets labeled as the Cysic bridge exploiter deposited about 300 ETH and 30.4 BNB into Tornado Cash on Friday. PeckShieldAlert flagged the move. Those Cysic Tornado Cash deposits mark roughly $721,140 in ether and $22,590 in BNB. Combined, that is about $744,000. The transfers landed days after the Cysic Foundation offered a 10% bounty for return of most of the identified ETH proceeds.

That is the strange part of this dark web crypto crime follow-on. The project asked for cooperation on-chain. The labeled wallets answered with a classic laundering rail. They pooled the coins where many deposits meet, then waited.

PeckShield Tracks the Mixer Deposits

PeckShield’s alert on October 23 named an address labeled as the Cysic (@cysic_xyz) exploiter. That address was the source of the Tornado Cash deposits. The firm also restated the October 17 bridge incident. Attackers minted 10 million CYS without authorization on BNB Chain, as the Cysic Foundation described.

Tornado Cash mixes deposits from many users. Once funds sit in the pool, later withdrawals are harder to tie to a specific deposit. Off-chain clues still matter. For readers who track crypto crime rails, the Friday move is the familiar second act after a bridge mint. Convert. Hop. Then obscure.

The Bridge Mint Cysic Reported on October 17

In its incident report, the Cysic Foundation said the cross-chain bridge was hit on October 17, 2026. An attacker minted 10,000,000 CYS on BNB Smart Chain at 12:31:38 UTC without authorization. Cysic said the attacker gained unauthorized access to a database that supported the bridge. A flaw in processing logic then let a fraudulent mint message through. The full attack path, Cysic added, was still under investigation.

The foundation framed the event as limited to bridge message processing and minting. It said existing user assets in wallets were not stolen. It also said the Cysic mainnet was not affected. The bridge was suspended as containment. Cross-chain service through that bridge stayed closed while Cysic reviewed security.

Cysic published the mint recipient as 0xA4e1827Fe2664fD0797a55e442b2e2639449C255. The mint tx on BNB Smart Chain is 0x8de43ba77f9a14ecff1268acb9d7c9bf3afe1f2a45bd8d8681d824a2460000f6. At 13:47:52 UTC the same day, Cysic said that address was blacklisted in the CYS token contract on BNB Smart Chain. Cysic restricted transfers of about 2.8 million CYS still sitting there. Cysic stressed that the raw mint size was not the final dollar loss by itself.

On October 19, the foundation said all relayers remained paused. Deposited CYS in bridge contracts stayed secure. The bridge would reopen only after security checks finished.

The 10% Bounty and the 72-Hour Clock

On October 22, the Cysic Foundation posted a direct offer to the party behind the exploit. It offered an approximate 10% bounty if the actor returned about 90% of the identified ETH proceeds from the unauthorized CYS mint. The ask was precise. Return 275.872 ETH on Ethereum mainnet to a Foundation-controlled address, 0xe3e8E1147a47dCf42fa73892D74928544fe5a6A9.

If that amount arrived inside a 72-hour window from the on-chain publication of the message, the actor could keep about 30.652 ETH as the bounty. Cysic said it would publicly acknowledge cooperation. It would also treat its ETH claim under the offer as resolved. If the funds were not returned by the deadline, Cysic said it would escalate the matter to law enforcement for a full criminal investigation. Cysic published the same terms as on-chain messages on BNB Chain and Ethereum.

The project account @cysic_xyz amplified the same offer the same day.

Why the Cysic Tornado Cash Move Matters

Why did it matter? Because a posted bounty is a negotiation. A mixer deposit is an exit.

Cysic tried the white-hat script that many protocols use after a bridge failure. Name a return address. Price a keep-back fee. Set a clock. Threaten prosecution. PeckShield’s Friday alert shows labeled proceeds moving into Tornado Cash instead. That does not prove every stolen dollar is gone forever. It does show the cash trail shifting into a tool built to break easy wallet-to-wallet storytelling.

Bridge mints and mixer dumps sit on the same crime map as other crypto hacks. Those attacks turn protocol bugs into portable assets. The Cysic case is also a reminder for crypto scams readers. The first headline is often the exploit. The quieter headline is where the coins go next.

New tech changes the surface of theft. The psychology stays old. Offer a cut for silence or return. Watch whether the other side takes the deal, or reaches for a darker pool.