Cryptocurrency wallets linked by security researchers to the recent Cysic bridge exploit have transferred approximately $743,700 in digital assets into Tornado Cash, raising questions about the recoverability of funds associated with the unauthorized issuance of 10 million CYS tokens.
Blockchain security firm PeckShield reported on October 23, 2026, that addresses it labeled as associated with the Cysic attacker deposited 300 ether (ETH), valued at approximately $721,100, and 30.4 BNB, worth about $22,600, into the cryptocurrency privacy protocol.
The transfers represent a new development in the movement of assets associated with the October 17 security incident, rather than evidence of another exploit against Cysic. The identity of the wallet controllers and the ultimate destination of funds after entering Tornado Cash have not been established.
The development comes as Cysic pursues a recovery arrangement offering the attacker a 10% bounty in exchange for returning most of the ETH proceeds identified from the original incident.
PeckShield Tracks 300 ETH and 30.4 BNB Into Tornado Cash
In its October 23 blockchain monitoring alert, PeckShield identified two cryptocurrency transfers associated with addresses it attributed to the Cysic exploiter.
The larger movement involved 300 ETH, worth approximately $721,100 at the reported valuation. A separate transfer involved 30.4 BNB, valued at approximately $22,600.
Together, the deposits were worth roughly $743,700. These amounts reflect cryptocurrency valuations around the time of the alert and should not be interpreted as a new loss added to the original exploit.
The distinction is important because blockchain investigators frequently continue tracking assets for days or months after an initial security breach. Subsequent transfers may reveal how proceeds are being moved without indicating that additional funds have been taken from the affected project.
PeckShield’s attribution identifies the relevant addresses as connected to the attacker, but wallet labels are analytical assessments rather than independently established identities. The alert does not demonstrate who controlled the wallets when the deposits occurred or whether all the assets originated directly from the unauthorized CYS mint.
Tornado Cash uses privacy-preserving smart contracts that make it difficult to connect deposits with subsequent withdrawals. The transfers therefore complicate efforts to establish where the assets ultimately go, although they do not establish that any funds have already been converted into cash.
Similar attribution limitations have appeared in recent Aztec Connect exploiter-linked Tornado Cash deposits, where investigators identified substantial transfers but could not independently establish their final beneficiaries.
How Did the October 17 Cysic Exploit Generate $727,000?
The latest activity follows a security incident on October 17 in which an attacker exploited Cysic’s cross-chain bridge to mint 10 million CYS tokens without authorization on BNB Smart Chain.
According to the Cysic Foundation’s initial investigation, the attacker obtained unauthorized access to a database supporting bridge operations and exploited a weakness in message-processing logic to submit a fraudulent minting instruction.
The unauthorized mint occurred at 12:31:38 UTC. Cysic subsequently suspended its bridge and blacklisted the receiving address at 13:47:52 UTC, approximately 76 minutes later.
However, blockchain transaction records showed that approximately 7.2 million of the newly minted tokens had already been sold before the blacklist became effective. Around 2.8 million CYS remained at the restricted address.
The attacker converted the tokens into USDT and BNB through decentralized trading infrastructure before transferring proceeds across blockchains using services including Mayan, deBridge and SWFT’s Bridgers.
On-chain investigations identified approximately 306.6 ETH reaching Ethereum, worth roughly $727,000 at the valuation used in the original reporting.
Those funds were subsequently consolidated into another Ethereum wallet. The newly reported 300 ETH Tornado Cash deposits are close in magnitude to the previously identified ETH proceeds, although the full relationship between the specific transfers requires transaction-level confirmation.
Cysic emphasized that the incident affected its bridge’s message-processing and minting infrastructure rather than its mainnet. The foundation said existing assets held in user wallets had not been directly stolen and cautioned that the 10 million unauthorized tokens did not automatically represent an equivalent dollar loss.
Cysic Offers 10% Recovery Bounty as Funds Move Toward Privacy Infrastructure
A separate development on October 22 introduced another dimension to the recovery process.
Cysic delivered an on-chain message offering the party responsible for the unauthorized mint a recovery bounty of approximately 10% of the identified ETH proceeds.
Under the proposed arrangement, the attacker would return 275.872 ETH to an address controlled by the Cysic Foundation within 72 hours of the message’s publication on Ethereum.
In exchange, the attacker could retain approximately 30.652 ETH, bringing the identified proceeds covered by the proposal to roughly 306.524 ETH.
The foundation indicated that failure to cooperate within the specified window would prompt escalation involving law enforcement and a criminal investigation.
The October 23 Tornado Cash transfers occurred after that recovery proposal was reported, making the timing potentially significant. However, the transfers alone do not establish that the attacker formally rejected the offer or that the deposited assets can be definitively matched to every component of the proposed settlement.
No confirmed repayment or acceptance of the recovery arrangement had been established in the reviewed information.
Why Tornado Cash Deposits Could Complicate the Recovery of Cysic Funds
The most important implication of the latest transfers concerns recoverability rather than the dollar amount itself.
Before assets enter privacy infrastructure, investigators can often follow their movement between ordinary blockchain addresses, identify exchanges and bridges involved, and potentially coordinate with intermediaries that can restrict suspicious funds.
Once assets enter Tornado Cash, the publicly visible relationship between a particular deposit and subsequent withdrawal becomes much harder to establish.
That does not make recovery impossible. Investigators may still rely on additional transaction patterns, off-chain records, cooperation from centralized platforms or information obtained through legal processes.
Nevertheless, the transition reduces the usefulness of straightforward public transaction tracing and could make it more difficult for Cysic to establish where the identified proceeds ultimately reside.
The same challenge has emerged in other major cryptocurrency investigations. Dave Finances recently reported how Drift exploiter-linked wallets moved approximately $61.6 million into Tornado Cash, creating additional uncertainty for efforts to track assets associated with that earlier breach.
Another investigation involving suspected stolen cryptocurrency routed through Tornado Cash and Tron illustrates how complex tracing becomes when funds cross multiple networks and intermediaries.
What Does the Fund Movement Mean for CYS Investors?
For CYS holders, the immediate risk is not simply that approximately $743,700 entered a privacy protocol. Those deposits are movements of existing assets, not evidence of another $743,700 being extracted from the Cysic ecosystem.
The more relevant concern is whether the project can resolve the consequences of the unauthorized token issuance and restore confidence in its bridge infrastructure.
The October 17 incident exposed a weakness in the controls governing cross-chain minting. Although the foundation successfully restricted approximately 2.8 million unauthorized CYS, most of the tokens had already moved before its intervention.
That difference matters. Freezing tokens still held in an attacker-controlled address does not reverse previous sales or automatically recover assets obtained through those transactions.
As explained in Dave Finances’ analysis of the limits of freezing and recovering stolen cryptocurrency, identifying assets, restricting their movement and ultimately returning economic value are separate stages of the recovery process.
For investors, the unresolved questions include the amount Cysic can actually recover, whether the bridge’s underlying vulnerability has been fully addressed, and whether the foundation will publish independently verifiable findings about the incident.
The proposed 10% bounty also creates an interesting economic trade-off. Recovering approximately 90% of the identified ETH proceeds would leave the project substantially better positioned than recovering nothing, although that outcome remains uncertain.
If the assets become harder to trace, however, negotiating or enforcing any recovery arrangement may become more complicated.
The October 23 PeckShield alert therefore marks an important development in the original Cysic investigation. The central question is no longer only how 10 million unauthorized CYS tokens were created, but whether the proceeds can still be identified and recovered after moving into privacy infrastructure.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574