Cysic Bridge Mints 10M Tokens, Attacker Routes $744K Into Tornado Cash
An attacker exploited Cysic's bridge to mint 10 million tokens on BNB Smart Chain, then pushed $744,000 in ETH and BNB through Tornado Cash. Cysic answered with a 10% bounty offer, which is roughly the value of a rounding error next to a mint function. The real problem is issuance authority, not liquidity.
Cysic's bridge had one job. It failed at it. An attacker minted 10 million tokens on BNB Smart Chain through the bridge contract, then routed $744,000 in ETH and BNB into Tornado Cash. Supply on that chain now carries 10 million units that nobody paid for.
The company's response was a 10% bounty offer. That's the standard playbook now, and it's a weak one. Ten percent of a bridge exploit is a rounding error next to what a mint function is worth. The attacker already had a mixer in the loop, which tells you they priced the bounty at zero before they sent the first transaction.
The technical picture matters more than the dollar figure. Bridge contracts that mint on the destination chain hold unilateral supply authority. If the validation path for that mint call is wrong, an attacker doesn't need to steal liquidity. They just create it. That's the difference between a drain and an inflation bug, and inflation bugs are worse for holders because every existing balance gets diluted the moment the transaction confirms.
Tornado Cash routing is the second detail worth flagging. $744,000 in ETH and BNB through a mixer isn't a sophisticated laundering operation. It's a shortcut that works because the deposits are large enough to blend and small enough to avoid the scrutiny that a nine-figure haul attracts. Chain analysts can follow deposits in. They can't follow withdrawals out with any precision. The funds are effectively gone.
So who loses. Holders of the token on BNB Smart Chain, first and obviously. Cysic's credibility second. Bridges third, because every audit team reading this will now ask the same question about mint authority, and a lot of projects won't like the answer.
Developers should note the breaking change in the threat model. A bridge that mints is a bridge that issues, and issuance authority deserves the same controls as a proxy admin key. Backward compatibility is maintained except where noted below, and what's noted is 10 million tokens that shouldn't exist.
Explore More
Key Terms Explained
A reward offered by crypto projects for completing specific tasks like finding bugs, writing code, or creating content.
A protocol that lets you move tokens between different blockchains.
The rate at which prices rise and money loses purchasing power.
How easily an asset can be bought or sold without significantly affecting its price.