A hacker exploited Symbiosis's bitcoin bridge and minted roughly 46.1 billion in face value of unbacked syBTC, but managed to cash out only about $336,000 in wrapped bitcoin before the rest went unsold. Symbiosis has recovered 15 BTC and offered the attacker a 20% white-hat bounty ahead of a Sept. 13, 2026 deadline. It is the third bitcoin-backed token to suffer a similar unbacking failure in a matter of weeks.
Blockaid Flags Symbiosis Bridge Exploit
The onchain security platform Blockaid discovered the issue this week. It described the mechanism on X: a signed BridgeV2 receive minted roughly 2^62 raw syBTC, with a face value of about $46.1 billion, to a fresh externally owned account.
That same beneficiary then dumped about 4.39 WBTC on Ethereum's Uniswap V4, realizing roughly $336,000 in proceeds so far. The rest of the minted syBTC was phony supply with no buyer. Symbiosis confirmed the attack on X shortly after.
Symbiosis Recovers 15 BTC, Offers 20% Bounty
Symbiosis said the attacker struck at approximately 04:28 UTC on Sept. 11, 2026, exploiting a vulnerability in its bitcoin bridge. According to Symbiosis, the team has since recovered approximately 15 BTC, now held in a team-controlled multisig, and says "BTC routes have been halted. Other routes remain operational and safe."
The team has also offered the attacker a white-hat bounty of 20% of the funds, open until Sept. 13, 2026. After that window, the same 20% will go to anyone who provides information leading to recovery, the team says.
Third Bridge Failure in Weeks
The trick behind the Symbiosis exploit is not new. Blockstream's Liquid Network was drained for nearly 4,000 BTC using unbacked assets, and Nomic had a hole that went unnoticed for months under similar circumstances. All three incidents relied on the same basic trick: convincing a bitcoin wrapper project to print extra coins that were supposed to represent real tokens.
As of Sunday morning, Sept. 13, Symbiosis had published no public technical post-mortem explaining where BridgeV2 failed, no final dollar loss figure, and no public confirmation that the attacker had accepted its 20% offer.
Source: Bitcoin News
Trading involves risk.
Risk Disclaimer
