By A wallet linked to the Cysic bridge exploit has sent approximately $744,000 in Ether and BNB to Tornado Cash, complicating recovery efforts less than a day after the Cysic Foundation offered the attacker a 10% bounty for returning most of the identified proceeds.The address transferred 300 ETH, worth approximately $721,100 at the time, and 30.4 BNB, valued at about $22,600, into the privacy protocol on October 23. The combined transfers were worth roughly $743,700.
The movement follows Cysic’s October 17 bridge incident, when an attacker exploited the project’s cross-chain infrastructure to mint 10 million CYS tokens without authorization on BNB Smart Chain.
The latest transfers do not represent another exploit or an additional $744,000 loss. Instead, they involve assets attributed to the address associated with the earlier attack and indicate that at least part of the identified proceeds is now being routed through privacy infrastructure.
What Did the Cysic Exploiter Send to Tornado Cash?
Blockchain security firm PeckShield identified deposits of 300 ETH and 30.4 BNB from an address labeled as associated with the Cysic attacker.
Tornado Cash uses smart contracts that allow users to deposit cryptocurrency and later withdraw assets without maintaining a simple public link between the depositing and receiving addresses. Moving assets into the protocol therefore makes subsequent tracing substantially more difficult.
It does not, however, establish that the funds have been sold, converted into fiat currency or permanently removed from investigators’ reach. Transaction timing, subsequent exchange interactions and other on-chain evidence can still provide investigative leads.
The timing is particularly important because Cysic had just offered a settlement to the attacker. The foundation proposed allowing the recipient to retain 30.652 ETH as a 10% bounty if 275.872 ETH, representing approximately 90% of the identified Ether proceeds, was returned.
Cysic attached a 72-hour period to the proposal and said it would continue pursuing the incident if the funds were not returned. Because the Tornado Cash movement occurred before that full window had necessarily expired, the transfers should not by themselves be described as a formal rejection of the bounty.
Investor Takeaway
The $744,000 movement is not a new Cysic loss. Its importance lies in making recovery and attribution harder as the foundation attempts to negotiate the return of exploit proceeds.
How Much Did the Attacker Extract From the Cysic Exploit?
The original incident involved the unauthorized minting of 10 million CYS, equal to 1% of the token’s documented one-billion-token total supply. That figure measures unauthorized issuance rather than realized financial damage.
Cysic blacklisted the recipient address approximately 76 minutes after the unauthorized mint, leaving about 2.8 million CYS frozen in that wallet. The remaining 7.2 million tokens had already moved elsewhere, but their disappearance from the blacklisted address did not establish that all were successfully sold.
Cysic said its mainnet was unaffected and that existing assets held by users were not compromised. The incident was instead linked to infrastructure supporting the cross-chain bridge and the processing of messages used to authorize token minting.
The bounty terms provide additional evidence about the proceeds Cysic had identified by October 22. Asking for 275.872 ETH back while allowing the attacker to retain 30.652 ETH implies approximately 306.524 ETH was covered by that particular recovery proposal.
That amount should not automatically be treated as Cysic’s final loss. The project’s investigation still needs to reconcile the unauthorized token supply, swaps, bridge movements, frozen assets and any additional proceeds.
Why Does Tornado Cash Change the Recovery Equation?
Crypto projects frequently attempt direct negotiations after an exploit, offering the attacker a percentage of recovered assets in exchange for returning the remainder. FinanceFeeds’ analysis of cross-chain bridge recovery shows that these negotiations can work when attackers still control traceable assets and have an incentive to settle.
The outcome varies considerably. In May, the Verus bridge attacker returned 4,052 ETH after accepting a negotiated bounty, allowing the exploiter to retain 25% of the stolen Ether.
Routing assets through privacy infrastructure creates a different recovery problem. Once deposits enter Tornado Cash, directly following the same units of cryptocurrency to a later withdrawal becomes substantially harder.
A similar issue has recently affected other exploit investigations. Wallets associated with the Drift Protocol attacker sent tens of millions of dollars in Ether into Tornado Cash, reducing the transparency available to victims and investigators trying to track the stolen assets.
Investor Takeaway
Cysic’s recovery prospects now depend less on freezing the original CYS and more on tracing converted proceeds, securing voluntary returns and determining how much economic value the attacker actually extracted.
What Should Cysic Investors Watch Next?
The most important next disclosure is a complete reconciliation of the exploit. Cysic still needs to establish how many of the 10 million unauthorized tokens were sold, how much value was extracted, what assets remain recoverable and whether any additional attacker-linked wallets retain proceeds.
The foundation also needs to explain whether the 275.872 ETH recovery demand remains achievable after the latest transfers and what action follows if the bounty period expires without repayment.
Separately, investors need confirmation that the bridge vulnerability has been fully remediated before cross-chain operations resume. Cysic previously said it had brought in external security specialists and would provide further findings after its investigation.
The October 23 Tornado Cash deposits therefore represent a new recovery development rather than a new security breach. The original bridge incident remains the source of the exposure; the latest question is how much of its proceeds Cysic can still identify and recover after attacker-linked assets began moving into a protocol designed to obscure their subsequent path.