The Cysic attacker sold 7.2 million unauthorised tokens within half an hour of minting them and walked off with about $727,000 in ether, The Block finds

The morning's unanswered question about the Cysic bridge exploit, where the missing 7.2 million CYS went, has an answer: they were sold within half an hour and the money is sitting in ether. The Block traced the receiving address on BNB Smart Chain and found it began moving tokens about five minutes after the unauthorised mint at 8:31am ET on Saturday. Between 8:36am and 8:41am it sold 5.65 million CYS in 11 transactions for 588,315 USDT, about $0.10 a token, and between 8:57am and 8:59am another 1.55 million for about 220 BNB. Twelve of the 15 sales went through OKX's DEX aggregator, which split them across exchanges including PancakeSwap.

The cash-out was just as quick. From 8:44am the USDT and BNB were pushed through three bridges, SWFT, Mayan and deBridge, and by 9:06am about 306.6 ETH had landed on Ethereum, worth roughly $727,000 at Sunday's ether price of about $2,372. By 9:11am, 306.52 ETH had moved on to a second wallet, funded about two hours before the mint, which held about 309.5 ETH on Sunday morning.

Cysic blacklisted the attacker's address at 9:47am ET, 76 minutes after the exploit and 48 minutes after the selling stopped, freezing the 2.8 million CYS still there. That blacklist applies only to CYS on BNB Chain, not the ether. In its incident report Cysic said the attacker "gained unauthorized access to a database" used by services supporting the bridge, and that existing user assets were not stolen. It says the minted token count does not by itself represent the final loss in dollars, has hired an unnamed security firm to investigate, and will keep the bridge closed until a review is complete, with a report on verified losses to follow.