Roughly 744,000 dollars in cryptocurrencies moved into Tornado Cash on October 23, 2026. The transaction originated from the wallet identified in the breach of Cysic’s bridge infrastructure.
#PeckShieldAlert The address labeled as the @cysic_xyz exploiter has deposited 300 $ETH (~$721.14K) and 30.4 $BNB (~$22.59K) into #TornadoCash.
— PeckShieldAlert (@PeckShieldAlert) October 23, 2026
On October 17, the Cysic cross-chain bridge suffered a security incident, with 10M base:0x19e8d59ff3d7a31289e0dc04db48d43b02c7ffa6… pic.twitter.com/cjgeimVnex
Blockchain security firm PeckShield confirmed the transfer consisted of 300 Ether and 30.4 BNB. The perpetrator routed the funds to the privacy pool shortly after receiving an official negotiation offer from the project foundation.
The breach occurred on Saturday, October 17, 2026, when an attacker manipulated a bridge vulnerability. This smart contract loophole allowed the unauthorized minting of 10 million Cysic (CYS) tokens directly on BNB Smart Chain.
A message from Cysic to the party responsible for the exploit:
— Cysic Foundation (@cysic_fdn) October 22, 2026
In the interest of reaching an amicable resolution, we are offering a recovery bounty of approximately 10% for your cooperation in returning approximately 90% of the identified ETH proceeds from the unauthorized…
Technical teams reacted by halting the bridge and blacklisting the recipient account. That swift response isolated 2.8 million newly minted tokens before the attacker could dump them into liquidity pools.
In an official update, the Cysic Foundation clarified that mainnet operations remained fully functional. The team stated that existing assets held in user wallets were entirely safe from the breach.
Failed negotiations and asset obfuscation
On Thursday, October 22, 2026, project operators attempted to recover the stolen capital through dialogue. The Cysic Foundation offered the hacker a 10% bounty payment in exchange for returning the remaining assets.
The settlement required the return of 275.872 ETH, valued at approximately 665,000 dollars. This requested sum constituted roughly ninety percent of the identified Ether proceeds derived from the exploit.
The perpetrator rejected the proposal and shifted the capital into obfuscation tools. Routing through Tornado Cash to obscure transaction histories mixes diverse deposit pools, severely impairing standard on-chain tracking procedures.
Following the sequence of mixer deposits, on-chain records showed the primary extraction address empty. The hacker Ethereum wallet balance stood at just 45 dollars according to data indexed by Arkham Intelligence.
The Cysic Foundation did not reply to inquiries regarding legal escalation or law enforcement coordination prior to publication.
This article is for informational purposes only and does not constitute financial advice.
