入门 Cysic offers 10% white-hat bounty to attacker — ETH return deadline expired
Quick answer
Cysic publicly offered the attacker behind its recent exploit a 10% white-hat bounty on stolen funds, contingent on full repayment of all withdrawn ETH within 72 hours — a deadline that expired on 2026-10-25 at 23:59 UTC. No confirmation of fund return or bounty acceptance has been published as of the source timestamp (PANews, 2026-10-22). The incident highlights structural exposure in modular zero-knowledge infrastructure projects, particularly those relying on un-audited bridge logic between execution and settlement layers.
What triggered Cysic’s public bounty offer?
On or before 2026-10-22, an unauthorized withdrawal occurred from Cysic’s protocol, resulting in loss of ETH held in its settlement contract. According to PANews’ reporting dated 2026-10-22, Cysic identified the transaction origin and issued a time-bound proposal: return 100% of the stolen ETH within 72 hours in exchange for retaining 10% as a coordinated disclosure reward. The offer was communicated via on-chain message and verified social media channels. No dollar value, ETH quantity, or wallet address was disclosed in the source. PANews did not specify whether the exploit targeted the sequencer, the prover network, or cross-layer messaging — only that it involved ‘unauthorized asset movement’.
How does this affect market participants across language regions?
For English-, Traditional Chinese-, and Simplified Chinese-speaking readers tracking regulatory alignment and asset custody risk, this event signals heightened scrutiny for ZK-based rollup infrastructures operating without formal third-party audit trails. Unlike Ethereum L1 smart contracts, which benefit from multi-firm audit convergence, modular zk-stack components like Cysic’s verifier coordination layer lack standardized compliance benchmarks. That gap affects how exchanges list related tokens, how custodians assess collateral eligibility, and how regulators classify cross-chain settlement failures. No jurisdictional enforcement action or statement was reported by PANews as of 2026-10-22. The absence of quantified loss data limits impact modeling for liquidity providers and stakers — a key uncertainty for market participants evaluating exposure to similar modular architectures.
What remains unresolved after the 72-hour window closed?
The 72-hour deadline expired on 2026-10-25. As of the source’s publication date (2026-10-22), no on-chain evidence of ETH return had been verified, nor had Cysic confirmed receipt or bounty disbursement. PANews reported no chain analysis confirming whether the attacker’s wallet interacted with Cysic’s recovery contract or responded to the proposal. This silence introduces ambiguity about whether the offer was technically actionable (e.g., lacked a signed recovery instruction or gas-subsidized transaction path) or whether the attacker rejected engagement outright. Without updated on-chain or official comms post-deadline, analysts cannot determine whether the incident will evolve into a forensic collaboration, a legal escalation, or an unaddressed loss.
Frequently asked questions
Question: Did PANews report how much ETH was stolen? Answer: No. The source article published on 2026-10-22 states only that ‘ETH was withdrawn without authorization’ and makes no reference to quantity, USD value, or block height. No secondary source cited in the article provides those figures.
Question: Is Cysic listed on any major exchange? Answer: As of 2026-10-22, PANews did not report exchange listings for Cysic’s native token or governance asset. Its infrastructure is currently deployed as permissionless backend service, not a tradable security. Readers seeking real-time listing status should refer to the /en/coins/ directory for verified entries — though Cysic does not appear there as of this writing.
Risk warning and disclosure
Digital asset protocols carry inherent technical, custody, and counterparty risks. This article reports factual developments from PANews (published 2026-10-22) and does not constitute financial advice, endorsement, or prediction of outcome. Cryptodlhub receives referral compensation for traffic directed to /go/binance-download/, but does not control Binance’s product features, fees, or terms. Official domain binance.com operates independently. Readers should verify all claims against primary sources and consult independent advisors before acting. For foundational concepts, see our /en/glossary/ and /en/news/ archives.
Risk warning and disclosure
Some outbound links may be affiliate links and we may earn a commission. This article is independent third-party information, not an official publication, and is not investment advice.
Related reading
Related News
入门 Whale swaps 1,847 BTC for 63,000+ ETH in 11 days — structural shift or tactical rebalancing?
A large-capacity address moved 1,847 BTC and acquired over 63,000 ETH between October 11–21, 2026. This represents ~0.095% of Bitcoin’s circulating supply…
入门 Three whale addresses withdraw 24,178 ETH from exchanges — structural shift or short-term rebalancing?
Three unidentified Ethereum wallets withdrew 24,178 ETH from Binance, OKX, and Bybit between October 19–21, 2026. This report analyzes on-chain evidence,…
入门 Fearless Wallet private key exposure lasted 18 months; 8 users report theft
An unpatched private key vulnerability in Fearless Wallet persisted from early 2025 to mid-2026, leading to verified unauthorized transfers by at least ei…
Follow the market on a major exchange
Download Binance or OKX from the official website to start trading.