Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash

The attacker moved $744,000 in ETH and BNB to Tornado Cash after exploiting Cysic’s bridge to mint 10 million tokens on BNB Smart Chain.

The wallet linked to the Cysic bridge exploit sent about $744,000 in cryptocurrencies to Tornado Cash on Friday after the Cysic Foundation offered the attacker a 10% recovery bounty.

The address transferred 300 Ether (ETH) and 30.4 BNB to the crypto mixer, according to blockchain security company PeckShield.

The hacker exploited a bridge vulnerability to mint 10 million Cysic (CYS) tokens on BNB Smart Chain on Saturday. Cysic suspended the bridge and blacklisted the recipient address, freezing about 2.8 million of the newly minted tokens. The foundation said its mainnet and existing assets in user wallets were unaffected.

The following Thursday, the Cysic Foundation offered the hacker a 10% bounty in exchange for returning 275.872 ETH, worth about $665,000, representing roughly 90% of the identified Ether proceeds.

Tornado Cash pools deposits from multiple addresses, making the funds harder to trace. The attacker’s Ethereum wallet held just $45 in ETH at press time, according to Akham data.

Cointelegraph contacted the Cysic Foundation for comment on fund recovery efforts but did not receive a response by publication.

Related: PHP flaw draws millions of exploit attempts, Cloudflare CEO warns

Subscribe to daily byte-sized crypto news from Cointelegraph

More on the subject