Cysic bridge exploit: the attacker’s gas came from Cysic’s own staking-operator wallet, and all 306.5 ETH still sit on one address

Cysic paused its cross-chain bridge after 10 million CYS (0x0c69199c1562233640e0db5ce2c399a88eb507c7) were minted on BNB Chain without a matching deposit. The Cysic Foundation said its preliminary findings point to unauthorized access to a database that supports the bridge, combined with a flaw in how messages are processed, and that existing user assets were not stolen. On 18 October The Block traced the proceeds: 7.2 million CYS sold, about 306.6 ETH bridged to Ethereum, and the ether forwarded to a second wallet.

We read the same wallets on 19 October 2026 and confirm those numbers. Below is what the chain adds.

The mint transaction was sent to the bridge contract 0x1ab77F94a46782c203b427b0aa5e6801870239fA by 0x373f11B24a5B163DA54900342c438A01e0143944. That address is not the attacker’s: it is the relayer that signs every ordinary withdrawal from the bridge, on 17 October and before. It received the forged instruction and executed it like any other. That fits Cysic’s account that the attack came through the data behind the bridge, not through a stolen bridge key.

The 10,000,000 CYS went to 0xA4e1827Fe2664fD0797a55e442b2e2639449C255, an address with no history before that day. At 13:47:52 UTC the blacklist transaction froze the 2.8 million it had not sold.

A new address needs a little BNB to pay for its first transactions. The attacker’s got 0.01 BNB at 12:32:42, a minute after the mint, from 0x2C60a77B808Efc4f0B049F6fB73060fC09034206, and 0.02 BNB at 12:34:49 from 0x874fe56cB7b4bB4B841D1A69F0b6C5AF039ce82F.

0x2C60a77B808Efc4f0B049F6fB73060fC09034206 is not a random wallet. For 52 days it has been the address that calls the administrative functions “Slash Providers” and “Approve Unstakes” on 0xfA405509cC13809627C0b490A9E1E9ee170E7074, the contract where CYS holders stake their tokens (it holds 37,220 CYS). It was funded with 0.1 BNB by 0xe3e8E1147a47dCf42fa73892D74928544fe5a6A9, a wallet that holds 39,095 CYS and manages CYS liquidity, and that same team wallet also funded 0x468B02Fa177FD91BaD91CB6d8525cD2A2066f1A8, the address that sent the blacklist transaction.

And the timing: at 12:21:51 and 12:23:19, ten and eight minutes before the forged mint, the operator wallet sent 0.04 BNB to 0x721fe1453b832f35403970aE11375c538B883C65 and 0.03 BNB to 0x874fe56cB7b4bB4B841D1A69F0b6C5AF039ce82F, two addresses created that minute. The first has done nothing since; the second forwarded 0.02 BNB to the attacker three minutes after the mint.

So whoever moved the attacker’s gas had the key of a Cysic operator wallet, and was using it before the mint happened. The chain cannot say whether that key was stolen together with the database or used by someone with legitimate access. It does show that the breach reached more than the bridge’s data.

Between 12:36 and 12:41 UTC the attacker sold 5.65 million CYS for 588,315 USDT, mostly through the OKX DEX router, which split the orders across PancakeSwap pools. Between 12:57 and 12:59 it sold another 1.55 million CYS for about 220 BNB, at a much lower price. 7.2 million CYS in total; the other 2.8 million were frozen before they could be sold.

The proceeds left BNB Chain through three services: 100,000 USDT sent directly to SWFT’s BridgersSwap contract, 488,315 USDT and 80 BNB through Mayan in seven orders, and 139 BNB through deBridge. All of them paid out to the same address on Ethereum, 0xA4e1827Fe2664fD0797a55e442b2e2639449C255 (the same key works on both chains): 40.88 ETH from SWFT, 224.66 ETH from Mayan, 41.05 ETH from deBridge — 306.59 ETH.

Between 12:47 and 13:11 UTC it forwarded 306.52 ETH in five transfers to 0x1106De394da07e90b02161465EA0421B74DB4691. That wallet also received 3 ETH from an unrelated busy address and held 309.53 ETH on 19 October. It has never sent anything out. Nothing has gone to a mixer.

Within minutes of each transfer, dozens of strangers sent zero-value transfers, fake “ETH” tokens and dust to the attacker’s wallets from addresses that start and end like its real counterparties: copies of the BridgersSwap contract on BNB Chain, copies of the parking wallet on Ethereum. This is address poisoning, aimed at anyone who copies an address from the attacker’s history. None of those addresses is part of the theft.

We marked 2 addresses as the attacker’s in our database: 0xA4e1827Fe2664fD0797a55e442b2e2639449C255 on BNB Chain and Ethereum, and the parking wallet 0x1106De394da07e90b02161465EA0421B74DB4691 on Ethereum. We added the parking wallet to our watchlist and will publish if the ether moves.

We did not mark the Cysic operator wallet, the two fresh wallets it funded, the relayer, the team wallets or the bridges: the chain links them to the attack, but it does not show who controlled the operator key on 17 October.

To check an address yourself, use the address check.

It does not say who the attacker is, that anyone at Cysic took part, or that OKX, PancakeSwap, SWFT, Mayan or deBridge did anything wrong. The amounts, the bridges and the Ethereum wallet were first published by The Block; the database access is Cysic’s own finding. The relayer reading, the gas from the staking-operator wallet, the two wallets funded before the mint and the team wallet behind both the operator and the blacklister are ours, read on 19 October 2026.