Cysic Attacker Moves Stolen Assets to Tornado Cash After Bridge Hack

On October 23, 2026, security monitoring services detected significant movement of funds associated with the recent security breach of the Cysic Foundation. The perpetrator behind the exploit has reportedly transferred approximately $793,730 worth of digital assets to the decentralized mixing protocol Tornado Cash. This development follows a major security incident involving the Cysic cross-chain bridge earlier this month, which resulted in the unauthorized creation of millions of native tokens.

Details of the Fund Movement and Asset Values

According to data provided by PeckShieldAlert, the address identified as the Cysic attacker initiated multiple transactions to obscure the trail of the stolen capital. The total amount transferred includes:

• 300 ETH, valued at approximately $775,140 based on current market rates.
• 30.4 BNB, worth roughly $18,590.

By utilizing Tornado Cash, a non-custodial privacy solution on the Ethereum and BNB Chain networks, the attacker aims to break the on-chain link between the source of the funds and their destination. Privacy mixers are frequently utilized by malicious actors to complicate the efforts of law enforcement and blockchain forensic firms in tracking stolen assets.

The Cysic Cross-Chain Bridge Incident

The origin of these funds traces back to a critical vulnerability exploited on October 17, 2024. During this event, the Cysic cross-chain bridge suffered a security breach that allowed the attacker to perform unauthorized minting of assets. Specifically, the hacker successfully minted 10 million CYS tokens on the BNB Chain.

On October 17, a security incident occurred on the Cysic cross-chain bridge, resulting in the unauthorized minting of 10 million CYS tokens on BNB Chain.

The Foundation confirmed the breach shortly after it occurred, highlighting the risks inherent in interoperability protocols. These bridges often serve as high-value targets for hackers due to the large volumes of liquidity locked within their smart contracts.

The recent transfer to mixing services indicates that the attacker is now moving into the liquidation phase of the operation. While the Cysic Foundation continues to monitor the situation, the use of automated privacy protocols remains a significant hurdle for asset recovery. This incident serves as a reminder for decentralized finance (DeFi) projects to implement rigorous smart contract audits and real-time monitoring to mitigate the impact of cross-chain exploits.