Your instinct is correct. You have received two things from your CTO: (a) a gift, and conventional etiquette (per Miss Manners) calls for thanking people who give you gifts, and (b) a commendation (the "thank you" part). Since they came together and you need to acknowledge the gift anyway, you can respond with something like "thank you for the bonus and the recognition". Especially when the recognition comes from the higher levels of an organization, you have everything to gain and nothing to lose by being a gracious recipient.
Since the CTO sent you email, you should respond in kind -- partly because you're just continuing the venue he chose, and mostly because it's prompt. Making him wait several days for your response could make him think you didn't appreciate the gift. If he had sent you a letter through physical mail, then it would be more complicated: responding on paper isn't wrong, but if this is someone you interact with regularly, via email or face to face, you might consider valuing promptness over formality and using email. It's best if your response arrives before your next encounter with him, to avoid any awkwardness (did he get it? did he appreciate it?).