Cysic has given a hacker 72 hours to return 275.872 ETH stolen through a bridge exploit in exchange for keeping 10% of the funds. The offer follows an attack that allowed the unauthorized creation of 10 million CYS tokens on BNB Smart Chain. Cysic warned that it could involve law enforcement if the hacker fails to return the funds.
Under the deal, the attacker can keep 30.652 ETH, worth approximately 10% of the identified proceeds. Cysic announced the offer on X and said it would publicly acknowledge the attacker’s cooperation if the repayment conditions were met.
Source: X
Cysic Gives Hacker 72 Hours to Return ETH
Cysic requires the attacker to send 275.872 ETH directly to a designated Ethereum address within 72 hours. In return, the attacker can keep the remaining 30.652 ETH.
The foundation said it had traced important parts of the attack and collected technical evidence. It is giving the attacker a limited time to return most of the funds before considering further legal action.
However, the 275.872 ETH figure does not represent the confirmed total loss from the incident. Cysic is still investigating how the attacker moved the tokens, exchanged assets and potentially caused additional losses.
The offer covers the ETH proceeds Cysic wants to recover. The project’s final financial losses remain unclear.
Cysic also made clear that the settlement depends on the attacker meeting the repayment conditions. If the funds are not returned before the deadline, the foundation could escalate the matter to law enforcement.
Bridge Exploit Allowed Hacker to Create 10 Million CYS Tokens
Cysic reported the attack on October 18 after a hacker exploited a weakness in its cross-chain bridge. The flaw allowed the attacker to create 10 million CYS tokens without authorization on BNB Smart Chain.
A cross-chain bridge allows users to move digital assets between different blockchain networks. If attackers exploit a weakness in this system, they may be able to create unauthorized tokens or move assets improperly.
According to Cysic’s incident report, the unauthorized token creation occurred at 12:31:38 UTC on October 17. The foundation later blocked the recipient’s address at 13:47:52 UTC by adding it to the token contract’s blacklist.
About 2.8 million CYS tokens remained at the blocked address. These tokens could no longer be transferred through the restricted address under the applied controls.
Meanwhile, CoinMarketCap data showed that approximately 160.8 million CYS tokens were in circulation. The 10 million unauthorized tokens, the 2.8 million remaining at the blocked address and the circulating supply represent different figures.
Source: CoinMarketCap
Cysic’s early investigation suggested that the attacker gained unauthorized access to a database used by the bridge. However, the foundation said it could not determine the incident’s total financial impact simply by looking at the number of tokens created.
The project also said the attack affected the bridge’s processing system and token creation process, rather than its wider network infrastructure.
Cysic stated that the incident did not result in the theft or unauthorized transfer of existing CYS tokens or other assets held in users’ wallets.
CYS tokens support rewards for users, computing providers, governance participants and other contributors to the Cysic network. The unauthorized creation of additional tokens raised concerns about the project’s security and the possible impact of increased supply.
ExVul Helps Investigate the Attack
Security firm ExVul joined Cysic’s investigation on October 19 to help determine how the attack happened and track the movement of funds.
The investigation includes examining how the attacker accessed the database and identifying weaknesses in the bridge’s system for processing cross-chain messages.
ExVul is also monitoring the movement of funds and the blocked address holding approximately 2.8 million CYS tokens. The firm is helping Cysic identify security improvements before the project resumes bridge operations.
Source: X
Cysic and ExVul plan to publish a joint report explaining their findings. Until then, the exact method used to access the system and the full movement of the proceeds remain under investigation.
The attack came amid other reported cryptocurrency security incidents during October. DeFi Warhol highlighted several cases on X, including a reported $14 million loss at 79thVault, a $3.8 million exploit involving NEAR Intents and unauthorized token creation at Autheo.
The post also mentioned a reported theft exceeding $3 million involving Gamdom and a $1.05 million loss at Affluent.
These incidents involved different platforms and attack methods. Their reported losses may also change as investigations continue. However, they highlight the security risks facing cryptocurrency services, including bridge weaknesses, unauthorized token creation and attacks involving digital wallets.
Separately, U.S. authorities are pursuing criminal cases involving overseas cryptocurrency scams.
At a White House cybercrime roundtable on October 21, President Donald Trump said authorities had frozen nearly $1 billion in cryptocurrency linked to foreign scammers and shut down more than 500 fraudulent websites.
The Justice Department’s Scam Center Strike Force reported that authorities had restrained approximately $938.5 million in cryptocurrency as of October 15.
Trump also said authorities had warned more than 10,000 Americans about potential scams and prevented at least $1.6 billion in losses this year.
These figures relate to investigations into alleged scam operations, not the Cysic exploit. Furthermore, freezing or restraining cryptocurrency does not necessarily mean authorities have recovered the funds or returned them to victims.
Cysic’s immediate priority remains recovering the identified ETH proceeds, completing its investigation and fixing the bridge vulnerability. The attacker has 72 hours to accept the proposed settlement terms before the foundation considers further legal action.
