A wallet linked to the exploit of Cysic’s bridge moved about $744,000 in cryptocurrency to Tornado Cash, shortly after the Cysic Foundation publicly offered the attacker a 10% recovery bounty.
The exploit involved a bridge vulnerability that let the attacker mint 10 million Cysic tokens on BNB Smart Chain. Cysic said it halted the bridge and blocked the recipient address, freezing roughly 2.8 million of the newly minted tokens, while stating that its mainnet and assets already held in user wallets were not affected.
Funds moved after bounty offer
According to the reported onchain activity, the address tied to the exploit sent 300 ETH and 30.4 BNB to Tornado Cash. Based on the figures cited in the report, the combined value of those transfers was about $744,000.
The transfers came after the Cysic Foundation offered the exploiter a white-hat style arrangement. On the following Thursday, the foundation said it would grant a 10% bounty if the attacker returned 275.872 ETH, valued at about $665,000, which it described as around 90% of the identified Ether proceeds.
How the bridge exploit unfolded
The incident centered on a vulnerability in Cysic’s bridge on BNB Smart Chain. By exploiting that weakness, the attacker was able to mint 10 million CYS tokens.
In response, the foundation said it suspended the bridge and blacklisted the address that received the minted tokens. It added that these measures allowed it to freeze about 2.8 million of the newly created tokens.
What Cysic said was unaffected
Cysic said the damage was contained to the bridge incident and that its mainnet was unaffected. The foundation also said that existing assets already sitting in user wallets were not impacted by the exploit.
Those statements are important because the exploit involved newly minted tokens created through the vulnerable bridge process, rather than a broader compromise of all user-held funds across the network.
Current status of the exploiter wallet
After the transfers to Tornado Cash, the attacker’s Ethereum wallet held only about $45 in ETH at press time, according to the report.
Tornado Cash is a crypto mixer that combines deposits from many addresses, which can make fund flows more difficult to follow onchain. The next confirmed step from Cysic, based on the source report, was its offer of a 10% bounty in exchange for the return of most of the identified Ether proceeds.
Source: cointelegraph.com