Cysic's Hacker Just Rejected Free Money — and That Should Worry You
A hacker who drained $744,000 in ETH and BNB from Cysic's bridge looked at a 10% bounty offer, ignored it completely, and funneled the entire haul into Tornado Cash.
That detail matters more than the exploit itself.
When attackers reject negotiated exits, it signals one of two things: they are confident they cannot be traced, or the payout is large enough that a 10% reduction is not worth the exposure. In this case, $74,400 left on the table suggests the attacker is not sweating the heat.
How the Exploit Worked
The attacker targeted Cysic's cross-chain bridge and exploited a vulnerability that allowed them to mint 10 million tokens directly on BNB Smart Chain. Those tokens were then converted into real value, with the proceeds split across ETH and BNB before being routed into Tornado Cash, the go-to mixing protocol for on-chain laundering.
Cysic's response was textbook: freeze what you can, post a bounty, hope the attacker blinks. The attacker did not blink.
The Tornado Cash Signal
Tornado Cash usage by hackers has become a reliable indicator of attacker sophistication. Unsophisticated actors panic-sell and move funds carelessly. Sophisticated ones wait, split, and mix. This attacker moved methodically, suggesting pre-planned exit routes rather than improvised chaos.
For protocols still relying on bridge infrastructure without multi-layered mint controls, this is not a hypothetical warning anymore. Bridges that allow uncapped or unvalidated minting on destination chains remain the single most exploited vector in DeFi. The Cysic incident joins a long list that includes Ronin, Nomad, and Wormhole as proof that bridge security is still an unsolved problem.
What the Bounty Rejection Tells the Market
Cysic's 10% offer was designed to recover funds while avoiding a protracted on-chain investigation. Hackers who accept these deals usually do so because tracing risk is high. This attacker's refusal signals low perceived risk, which is a broader problem for the ecosystem.
If Tornado Cash continues functioning as a reliable exit ramp and on-chain forensics cannot close the gap fast enough, bounty offers become theater rather than strategy.
What to Watch Now
Track whether Cysic's token holds any value post-exploit. Unauthorized minting of 10 million tokens is a supply shock, and holders should monitor for aggressive selling pressure as the attacker may still control unconverted positions.
For DeFi users broadly: audit the bridge infrastructure of any protocol you are currently farming or holding. If minting controls on destination chains are not explicitly documented, assume the risk is live.