Symbiosis (Bitcoin bridge syBTC mint) hack — September 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Cross-chain bridge |
| Loss | $336,000Price at time of incident |
| Method | Contract logic errorA call to the signed receive function of Symbiosis's BridgeV2 contract minted about 2^62 raw units of unbacked syBTC; Symbiosis has not published how the call came to be accepted |
| Chains | BNB Chain, Ethereum |
| Outcome | Unresolved |
What happened
Symbiosis, a cross-chain liquidity protocol, had its Bitcoin bridge exploited at about 04:28 UTC on 11 September 2026. A call to the signed receive function of its BridgeV2 contract on BNB Chain minted roughly 2^62 raw units of syBTC, Symbiosis's synthetic bitcoin, to a newly created wallet. At eight decimals that is about 46.1 billion syBTC, over 2,000 times all the bitcoin in existence. DefraudTG counted about 368.9 billion syBTC across Ethereum and BNB Chain after eight bridge transactions. Blockaid and DefraudTG flagged the incident; Symbiosis has not published a root cause.
Almost none of it could be sold. The attacker converted about 4.39 WBTC through Uniswap v4 on Ethereum, roughly $336,000 at the time, and that is the figure recorded here. It is what the attacker was seen to realise, not a final loss. Symbiosis says its accounting is still under way and that it is contacting every affected liquidity provider and building a compensation framework, but it has not said what those providers lost.
The team says it has secured about 15 BTC, some $1.15m, in a team-controlled multisig. It has not said where those coins came from, so they are not recorded as recovered from the attacker. A 20% white-hat bounty offered to the attacker expired on 13 September, and the same 20% now applies to information that leads to recovery. Only the Bitcoin bridge was affected and it remains paused; Symbiosis's other routes kept working.
Sources
- crypto.newsSecondary · retrieved 2026-09-15
- CryptoSlateSecondary · retrieved 2026-09-15
- The Crypto TimesSecondary · retrieved 2026-09-15
- Crypto DailySecondary · retrieved 2026-09-15
Changes to this entry
- Recorded four days after the incident. The amount is the roughly $336,000 the attacker realised from 4.39 WBTC, as traced by Blockaid; the minted syBTC had no market and is not valued. Symbiosis has not finished its loss accounting or said where the 15 BTC it secured came from, so both figures may change.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Symbiosis (Bitcoin bridge syBTC mint) hack — September 2026", iTokenly, accessed 2026-09-15, https://itokenly.com/hacks/symbiosis-btc-bridge-sybtchttps://itokenly.com/hacks/symbiosis-btc-bridge-sybtcPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.