blockintAI · Research blog

One Saturday, Three Exploits: A Forged Bridge Mint, a Front-Run Lending Drain and a Flash Loan From a Tornado-Funded Wallet

BlockintAI · 2026-10-21T17:00:00.000Z

BlockintAI research. On-chain balances, nonces and transactions were re-checked on Monday, October 19, 2026, at about 7:03 PM Central Time (CT), using Etherscan and BscScan data. Times are CT unless marked UTC. Dollar figures are the ones published by the projects, security firms and reporters cited; token amounts are from the transactions themselves.

Saturday, October 17, 2026 was a bad day for three small corners of decentralized finance (DeFi).

Just after midnight Central Time, a lending market on Ethereum that nobody had touched in five weeks was drained of about $165,600, and a bot that has made a name for itself front-running attackers walked off with the money. At 7:31 AM, someone forged a message on a cross-chain bridge and printed 10 million tokens out of nothing. At 9:47 AM, a wallet that had been quietly funded through Tornado Cash in September ran one large flash-loan transaction against a small token on BNB Chain and came out about $69,000 richer.

The three attacks are unrelated. They used different chains, different tricks and, as far as anyone can tell, different people. Put side by side, they show the three ways these stories usually end: money that is frozen too late, money that comes back, and money that goes into a mixer.

Key facts
Cysic bridge (BNB Chain → Ethereum) Oct 17, 2026, 7:31 AM CT (12:31:38 UTC): 10,000,000 CYS minted to 0xA4e1827F…9C255 by a fraudulent bridge message, per the Cysic Foundation. 7.2M CYS sold within 28 minutes; about 306.6 ETH (about $727K, per The Block) bridged to Ethereum; 306.52 ETH forwarded to a second wallet by 8:11 AM CT. CYS blacklist on the mint address at 8:47 AM CT
Cysic, today The mint address still holds 2.8M blacklisted CYS. The second wallet, 0x1106De39…4691, held 309.53 ETH and had never sent a transaction (Oct 19, 7:03 PM CT). Cysic hasn't published a loss figure
BiFi Lending (Ethereum) Oct 17, 2026, 12:43 AM CT (05:43:11 UTC): about 165,575 USDT drained from BiFi's USDT market by a stale-interest bug, per DefimonAlerts. c0ffeebabe.eth replayed the attack one block after the original attacker deployed its contract
BiFi, today c0ffeebabe.eth returned 159,103.65 USDC to the BiFi USDT market contract on Oct 18 at 12:21 PM CT. 165,574.51 USDT was drained, so about $159,100 of roughly $165,600 came back, in a different stablecoin
TIP / TIPMine (BNB Chain) Oct 17, 2026, 9:47 AM CT (14:47:46 UTC): one contract-creation transaction flash-borrowed about 206,503 WBNB, traded through the TIP/SOL pool and left the attacker wallet with 667.23 SOL tokens. TenArmor puts the loss at about $68.5K
TIP, the money The attacker wallet was first funded on Sept 21, 2026 by a 0.997 BNB withdrawal from a Tornado Cash pool. After the attack it swapped the SOL for about 69,250 USDT, sent 20 BNB into Tornado Cash at 10:12–10:13 AM CT and paid the rest of the USDT to five other addresses. It held 0.0021 BNB on Oct 19
BlockintAI reports Cysic: mint recipient, second wallet. BiFi: front-runner, original attacker. TIP: attacker wallet and contracts

12:43 AM: an idle market, a stale clock and a faster bot

BiFi is a lending protocol. Its USDT market on Ethereum had been idle for about 264,000 blocks, roughly 36 days, when the attack came.

DefimonAlerts, a security monitoring service, explained the flaw in a post on October 18. The market's code stores the length of the idle gap the first time anyone acts on it in a block, and freezes the exchange rate. Every later action in the same block then re-applies 36 days of interest, at an interest rate that depends on how much is deposited and borrowed at that moment. An attacker who controls those amounts inside one transaction controls the rate.

So the attack needed a lot of money for a few seconds. According to DefimonAlerts, it flash-loaned 40.5 million USDT from Morpho, deposited it in growing tranches, borrowed 30 million to push the market's utilization up, and then ran a repay-and-withdraw loop that cashed out the inflated interest. Two passes drained about 165,600 USDT.

The transaction itself, 0x756c6805…ad14, confirms the shape. It sits in block 26,210,256 at 05:43:11 UTC. Its first token transfer brings in 40,499,999.99 USDT from Morpho's contract; its last returns the same amount. In between, 165,574.51 USDT went to a Uniswap pool in exchange for 68.06 WETH.

But that transaction wasn't sent by the person who found the bug.

One block earlier, at 05:42:59 UTC, the address 0x7c78a049fff71609990017b58a959e926e6ec4c6 deployed an exploit contract (tx 0x15b47e2c…a034). Twelve seconds later, before that contract could be used, the address known as c0ffeebabe.eth (0xc0ffeebabe5d…f29671) ran the same attack from its own bot contract and took the proceeds. In DefimonAlerts' words, c0ffeebabe.eth "front-ran it, replaying the attack from its own contract." AMLBot, an on-chain compliance firm, put it more bluntly: the original attacker "never executed and got nothing."

c0ffeebabe.eth is a long-running automated trader that watches for profitable pending transactions and copies them first. AMLBot calls it a "white-hat MEV bot," and it has handed back funds after earlier exploits.

It did so again. On October 18 at 12:21 PM CT (17:21:59 UTC), c0ffeebabe.eth sent 159,103.65 USDC to the BiFi USDT market contract (tx 0x9702900b…eaeb). The attack took 165,574.51 USDT, and the return came in USDC, a different stablecoin. With both pegged to the dollar, that is about $159,100 back of roughly $165,600 taken, about 96% in dollar terms. AMLBot described it as "completing a white-hat recovery."

The lesson for BiFi users is a strange one. The protocol's code was broken, and it was a bot, not a fix, that got the money back.

7:31 AM: a forged message mints 10 million tokens

Cysic builds hardware and a network for generating zero-knowledge proofs. Its bridge moves the CYS token between the Cysic chain and other networks, including BNB Chain.

In an incident report posted on X on October 18, the Cysic Foundation said its preliminary findings showed the attacker "gained unauthorized access to a database used by services supporting the bridge" and exploited a flaw in the processing logic "to submit a fraudulent mint message." Cysic said the incident was confined to the bridge, that the Cysic mainnet was not affected, and that existing user wallets were not touched. The bridge was closed while a security firm investigates. In a bridge update on October 19 at 12:27 PM CT, Cysic said: "All relayers remain paused… The bridge will reopen after all security checks are completed."

The mint is public. Transaction 0x8de43ba7…00f6, in BNB Chain block 128,170,791 at 12:31:38 UTC, created 10,000,000 CYS from the zero address and sent them to 0xA4e1827Fe2664fD0797a55e442b2e2639449C255.

What happened next was fast. According to The Block's review of the on-chain records, the address began selling five minutes later. It sold 5.65 million CYS for 588,315 USDT between 7:36 and 7:41 AM CT, mostly through OKX's DEX aggregator, and another 1.55 million for about 220 BNB between 7:57 and 7:59 AM CT. It moved the proceeds to Ethereum through three cross-chain services: SWFT's Bridgers, Mayan and deBridge. Etherscan tags two of the paying contracts on the Ethereum side as "Mayan: Swift v2 Destination" and "deBridge: DlnDestination." In all, the same address received about 306.6 ETH on Ethereum, which The Block valued at about $727,000.

Then it moved the ether on. Etherscan shows five transfers from 0xA4e1…C255 to 0x1106De394da07e90b02161465EA0421B74DB4691 on October 17:

Time (CT) Amount
7:47:35 AM 1.00 ETH
7:55:11 AM 100.00 ETH
7:56:59 AM 140.84 ETH
8:09:59 AM 23.68 ETH
8:11:35 AM 41.00 ETH
Total 306.52 ETH

The receiving wallet was not new to the plan. It first received a tiny amount of ETH at 5:29 AM CT that morning, about two hours before the mint.

Cysic's response came at 8:47 AM CT (13:47:52 UTC), when a transaction added 0xA4e1…C255 to the CYS token's blacklist (tx 0x3ed213fe…50c7). That was 76 minutes after the mint and 48 minutes after the last sale. It froze the 2.8 million CYS that were still unsold. It couldn't touch the ether, which was already on another chain.

At 7:03 PM CT on October 19, the mint address still held exactly 2,800,000 CYS. The second wallet held 309.53 ETH, and its nonce was still zero: it has never sent a transaction. The extra 3 ETH came from 0x8195D349…8364, a very high-volume address with no public label that also sent the wallet its first tiny deposits that morning.

These addresses also drew imitators. Lookalike addresses sent zero-value transfers to both wallets while and after the ether was forwarded, a pattern known as address poisoning. Addresses mimicking 0x1106…4691 hit the mint address, and addresses mimicking 0xA4e1…C255 hit the second wallet. Etherscan tags two of the 0xA4e1 lookalikes: 0xa4E15bD315702369D136F9CC51332c718fE3C255 as "Fake_Phishing8048898" and 0xa4efbc6c21cd18d41be1851ecc1ae8c0b449c255 as "Fake_Phishing8048902."

Cysic has not published a dollar loss. It says the number of tokens minted "does not, by itself, represent the final loss in U.S. dollar terms," and has promised a follow-up report.

9:47 AM: a small token, a big flash loan and a mixer at both ends

The third attack was the smallest and, on-chain, the most deliberate.

TenArmor, a blockchain security firm, flagged it on X at 8:29 PM CT on October 18: "a suspicious attack involving #TIP #TIPMine on #BSC, resulting in an approximately loss of $68.5K." It linked one transaction.

That transaction, 0xa7b879b5…95a3, was sent at 14:47:46 UTC on October 17 by 0x96bB3276f74fd736A8BC89dF5B934f5b7F3eF6cE. It was a contract creation. It created one contract, 0xdab0622e6bbbe2ac7e54f1269fa87014f8da5f04, which created a second, 0xa19b07b4632a81cc6c7ec6a4685fa7848da85629, which did the work, all inside the same transaction:

  1. It flash-borrowed about 206,503 WBNB (Tozvan, a security news site, identifies the lender as Lista DAO's Moolah contract).
  2. It supplied the WBNB to the Venus lending protocol and borrowed about 14,404 Binance-Peg SOL against it.
  3. It pulled more SOL from other pools and traded through the TIP/SOL pool on PancakeSwap (pair 0xb1e0fb41…f1219; TIP token 0x36d75b5a…1f4e).
  4. It repaid everything and sent the leftover, 667.23 SOL tokens, to 0x96bB…f6cE.

TenArmor's alert doesn't give a root cause, and no statement from the TIP or TIPMine team had been found on X when BlockintAI filed its report late on October 18. The transaction shows the profit came out of the TIP/SOL pool.

What makes this attacker interesting is what happened before and after.

Before. 0x96bB…f6cE was first funded on September 21, 2026, at 7:36 AM CT, with 0.99696 BNB. The BNB came from contract 0xd47438c8…82b3, whose verified source code on BscScan is named "ETHTornado" and whose on-chain denomination is 1 BNB: Tornado Cash's 1 BNB pool. The pool's own withdrawal record names 0x96bB…f6cE as the recipient, with about 0.003 BNB kept as a relayer fee. The wallet made one small trade that night and then sat still for almost four weeks.

After. Within two minutes of the attack, the wallet swapped all 667.23 SOL tokens for about 69,250 Binance-Peg USDT in three trades. Over the next 40 minutes it:

  • sent 10,000, 20,000 and 20,100 USDT to three addresses between 9:52 AM and 10:02 AM CT;
  • swapped 13,847.24 USDT for 19.14 BNB at 10:10 AM CT;
  • sent two deposits of 10 BNB each into Tornado Cash's 10 BNB pool at 10:12 and 10:13 AM CT, through the contract named "TornadoProxyLight";
  • sent the last 500 and 4,909.92 USDT to two more addresses at 10:27 and 10:29 AM CT.

That was the wallet's 17th transaction, and its last as of 7:03 PM CT on October 19, when it held 0.0021 BNB. Tornado Cash on one end and Tornado Cash on the other is a familiar pattern for attackers who plan ahead: the mixer breaks the link to where the starting money came from, and then to where the profits went.

Even this attacker got targeted. Thirteen seconds after its first USDT payment, 0xc4bde7e006012754933e84c3b1d34a26d2323711, a lookalike that shares the recipient's first and last four characters, sent it 0.00001 USDT. Address poisoning doesn't care who it fools.

Three endings

Frozen, but late. Cysic's blacklist worked exactly as designed and still came 48 minutes after the last sale. About 306.5 ETH sits in a wallet that has never moved it. Until it moves, there's nothing for an exchange to freeze.

Returned. BiFi's market got about $159,100 of roughly $165,600 back, in USDC rather than USDT, because the first attacker was slower than a bot that has a record of returning what it takes. That's luck, not security.

Mixed. The TIP attacker planned the exit before the attack. Twenty BNB went into Tornado Cash within half an hour, and the rest went to five other addresses.

What protocols and users can take from it

  • Idle markets are still live code. BiFi's bug needed a market that had sat untouched for weeks. Pausing markets nobody uses closes that door.
  • Bridges are only as safe as their message pipeline. Cysic's chain wasn't broken; the service feeding it messages was. Minting limits and delays on large mints would have capped the damage.
  • Speed matters more than the freeze. A token blacklist can't reach money that has already crossed to another chain.
  • Exploits draw address poisoning. Each of these incidents drew lookalike "poisoning" addresses within minutes, seeded into the wallets' transaction histories.
  • If you lost funds in one of these incidents, follow the project's official channels only and ignore anyone offering to recover money for a fee. You can report it to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov, and file a report at blockint.ai with the addresses and transaction IDs. It's free, and anonymous reports are accepted.

#DeFi #CryptoHack #Web3Security #BNBChain #Ethereum

Sources

Cysic

BiFi Lending

TIP / TIPMine