The wallet associated with the Cysic bridge exploit transferred approximately $744,000 in cryptocurrencies to Tornado Cash on Friday, shortly after the Cysic Foundation proposed a recovery bounty. According to blockchain security firm PeckShield, the address moved 300 Ether (ETH) and 30.4 BNB into the crypto mixer. This action followed the foundation's offer of a 10% bounty for the return of 275.872 ETH, valued at roughly $665,000, which represented about 90% of the identified Ether proceeds from the attack.
The underlying incident occurred when a hacker exploited a vulnerability in the bridge to mint 10 million Cysic (CYS) tokens on the BNB Smart Chain. In response, Cysic suspended the bridge and blacklisted the recipient address, successfully freezing approximately 2.8 million of the newly minted tokens. The foundation stated that its mainnet and existing assets within user wallets remained unaffected by the exploit.
Tornado Cash functions as a privacy pool that mixes deposits from multiple addresses, significantly complicating the tracing of funds. Data from Akham indicated that the attacker’s Ethereum wallet held only $45 in ETH at the time of reporting. Cointelegraph reached out to the Cysic Foundation for comment regarding ongoing fund recovery efforts but did not receive a response prior to publication.
The transfer of stolen assets to Tornado Cash immediately following a bounty offer highlights the limitations of voluntary recovery mechanisms in decentralized finance exploits. While the Cysic Foundation attempted to incentivize the return of funds through a 10% reward, the attacker’s decision to launder the majority of the proceeds suggests a prioritization of anonymity over potential financial gain from the negotiation. This dynamic underscores the persistent challenge protocols face in securing assets once they have been moved into privacy-preserving mixers, where traditional tracking methods become ineffective.
From an operational risk perspective, the partial success of freezing 2.8 million tokens demonstrates the value of rapid response infrastructure, yet it also reveals the gaps in cross-chain security controls. The fact that the mainnet remained unaffected provides some reassurance to users, but the loss of nearly $744,000 in liquid assets remains a significant blow. Future incidents may require more robust pre-emptive monitoring or automated circuit breakers to prevent such large-scale transfers before they reach mixing services.
