Cysic Exploit: How an Attacker Minted 10 Million CYS and Moved Over $700,000 Through Cross-Chain Protocols

In the first 28 minutes after the exploit, the attacker sold approximately 7.2 million CYS through decentralized exchanges and liquidity aggregators.

The sell-off happened in two stages.
The first ran from 12:36 to 12:41 UTC. During that window, the attacker swapped 5.65 million CYS for approximately 588,315 USDT. A large share of these swaps went through OKX DEX Aggregator, using liquidity from PancakeSwap.

The second stage took place between 12:57 and 12:59 UTC, when the attacker sold another 1.55 million CYS for roughly 220 BNB.

The attacker then began moving the proceeds from BNB Smart Chain to Ethereum through several cross-chain services: SWFT, Mayan, and deBridge.

In total, the attacker obtained approximately 306.6 ETH, worth around $727,000 at the time of the incident.
Later, 306.52 ETH was transferred to another Ethereum address:
0x1106De394da07e90b02161465EA0421B74DB4691
This wallet became a key starting point for tracing the funds further.

At 13:47:52 UTC, 76 minutes and 14 seconds after the unauthorized mint, the Cysic team blacklisted the attacker’s original address in the CYS token contract.

By then, approximately 2.8 million CYS remained at the address. Those tokens were blocked from further transfers, but the other 7.2 million CYS had already been sold.

So, while the attacker created 10 million unbacked tokens, the proceeds actually realized from the attack amounted to approximately $727,000. The project’s total financial loss requires a separate assessment.

According to Cysic Foundation’s preliminary report, the incident involved both unauthorized access to the bridge infrastructure and a flaw in its message-processing mechanism.

Initial findings indicate that the attacker gained access to a database used by the bridge’s services. They then exploited a logic flaw that allowed the system to accept a forged message and trigger the minting of CYS.
To understand why this worked, it helps to look at how cross-chain bridges operate.

When tokens move between blockchains, the bridge must verify that a mint on the destination network corresponds to a confirmed transaction on the source network. That requires a legitimate transfer message and a way to check its authenticity.

In Cysic’s case, the attacker managed to break that trust model.
Based on the available information, the forged message passed through the bridge infrastructure and caused 10 million CYS to be created on BNB Smart Chain. The mint went through the bridge’s normal message-processing flow, rather than the attacker directly calling an administrative function in the token contract.

After the attack, Cysic Foundation sent the attacker a message directly on Ethereum.
The team proposed a white hat bounty arrangement: return most of the stolen funds voluntarily and keep a portion as a reward.

The offer asked the attacker to:

• Return 275.872 ETH, approximately 90% of the identified funds, to the Cysic Foundation address: 0xe3e8E1147a47dCf42fa73892D74928544fe5a6A9.
• Keep 30.652 ETH, approximately 10%, as a reward for cooperating.
• Complete the return within 72 hours of the message being published on Ethereum.

If the attacker met these conditions, Cysic Foundation said it would publicly acknowledge their cooperation and consider its ETH recovery claims under the offer settled.

The team also stated that it had reconstructed the main stages of the attack and preserved technical and on-chain evidence. If the funds were not returned by the deadline, it intended to hand the evidence to law enforcement for a full criminal investigation.

Path 1. Tornado Cash → Arbitrum → Ethereum → KuCoin
This section follows the route labeled “Path 1” in the transaction graph.
In the first scenario, AML Crypto analysts identified three addresses that each received 100 ETH from Tornado Cash after the Cysic Bridge incident.

The match in the number and size of the withdrawals was worth examining. But what made these addresses particularly interesting was what happened next: all three followed an almost identical transfer pattern.

Step 1. Withdrawals from Tornado Cash
Three separate addresses each received 100 ETH from Tornado Cash. This matched the number and size of the deposits previously made by the Cysic Bridge attacker.

That match alone does not establish a link between the deposits and withdrawals. Other Tornado Cash users could have made similar transactions.

The addresses’ subsequent activity, however, provided more useful clues.

Step 2. Moving the funds to Arbitrum
After the Tornado Cash withdrawals, the funds from all three addresses followed similar routes.
They passed through a series of intermediary wallets, entered Arbitrum Bridge, and moved from Ethereum to Arbitrum.

Intermediary addresses and cross-chain transfers make automated tracing more difficult, particularly when an analysis covers only one network or relies on standard address-clustering methods.

Step 3. Returning to Ethereum through Stargate
The next shared feature was the use of the cross-chain protocol Stargate.
The funds passed through additional intermediary addresses on Arbitrum before being bridged back to Ethereum through Stargate.

All three routes followed the same sequence:
Tornado Cash → intermediary addresses → Arbitrum Bridge → Arbitrum → Stargate → Ethereum.

Moving funds between networks is not, by itself, evidence of wrongdoing. But when combined with prior use of Tornado Cash, numerous intermediary addresses, and coordinated repetition of the same route, it may indicate a deliberate attempt to make the funds’ origins harder to trace.

Step 4. Moving the funds to KuCoin
Once back on Ethereum, the funds continued through numerous intermediary wallets.
The traced routes eventually reached two addresses identified in the analysis as KuCoin deposit addresses:

• 0x40e8eda5e4dd3f171b58440aebeff651a841fa7a
• 0x8c70cb8fca4eebc4aaf786303ded639a4019e956

KuCoin therefore represents a potential endpoint of the observed on-chain route.
Several distinct behavioral indicators support this first scenario.

First, the number of addresses matched the attacker’s Tornado Cash deposits: three deposits of 100 ETH, followed by three withdrawals of the same denomination.

Second, all three addresses followed the same subsequent route, using intermediary wallets, Arbitrum Bridge, and Stargate before returning to Ethereum.

Third, the amounts changed substantially and were split across transfers, making simple amount-matching methods less effective.

Fourth, all the transactions under review took place after the Cysic Bridge incident, during the period when the stolen funds had already entered Tornado Cash.

Finally, AML Crypto found no other instance of the same pattern appearing across three addresses in the transaction data examined between the incident and the preparation of this report.

Taken together, these findings make the first scenario one of the more plausible routes for the funds linked to the Cysic Bridge attack.

This remains a heuristic attribution: a link inferred from observable patterns. There is no cryptographically verified connection between the specific Tornado Cash deposits and withdrawals. The route should therefore be treated as a supported analytical hypothesis, rather than a conclusively proven trail of stolen funds.

Path 2. A second round through Tornado Cash
The second possible scenario emerged from an analysis of other Tornado Cash withdrawals after the incident.

AML Crypto analysts identified another three addresses that each received 100 ETH from the same Tornado Cash pool.

Their subsequent behavior differed from the first group: after receiving the funds, these addresses deposited assets back into Tornado Cash.

The observed pattern was:
Tornado Cash → three addresses receiving 100 ETH each → new deposits into Tornado Cash.

It repeated the same numerical pattern: three addresses and three transactions of 100 ETH each. AML Crypto also found no other comparable repetition of this pattern within the period examined.
One possible explanation is that the funds went through another round of mixing to further obscure their origin.

Depositing assets into Tornado Cash again makes the investigation considerably harder by creating another break between incoming and outgoing transactions. After a second mixing round, there are more potentially related withdrawals to consider, and timing and behavioral clues become less useful for matching the flows.
Still, this activity could belong to unrelated Tornado Cash users and have no connection to the Cysic incident.

The investigation identified two possible routes for the 300 ETH that the Cysic Bridge attacker deposited into Tornado Cash.

The first involves withdrawals to three separate addresses, followed by transfers through Arbitrum Bridge, Stargate, and numerous intermediary wallets, potentially ending at KuCoin deposit addresses.

The second involves another round of deposits into Tornado Cash, making further attribution significantly more difficult.

Both scenarios rely on similarities in timing, transaction amounts, and behavior. The most significant finding, however, is three matching routes that use the same cross-chain protocols and converge on a small set of destination addresses.

That is a distinctive behavioral pattern and deserves further investigation.
Even so, with Tornado Cash, public data about a particular deposit alone cannot confirm that it funded a specific withdrawal..