Symbiosis (Bitcoin bridge syBTC mint) hack — September 2026

Symbiosis, a cross-chain liquidity protocol, had its Bitcoin bridge exploited at about 04:28 UTC on 11 September 2026. In roughly four minutes the attacker pushed twelve bogus deposits through the bridge on BNB Chain, Ethereum and Rootstock and minted about 46.1 billion syBTC, Symbiosis's synthetic bitcoin, more than 2,000 times all the bitcoin that will ever exist, starting from a deposit of 330 satoshis, about 25 cents. Blockaid and DefraudTG flagged the incident.

Symbiosis published a post-mortem on 15 September. Two flaws combined. The bridge looked at the wrong part of a bitcoin transaction when deciding who had sent it, which let the attacker be treated both as an approved depositor and as the bridge administrator. With that access the attacker set the bridge's minimum fee below zero, and a second bug subtracted the negative fee from the deposit amount, which increased it, so a deposit could be credited as whatever figure the attacker supplied.

Almost none of it could be sold. Before the attack syBTC supply stood at just 13.91 tokens, 11.26 of them in liquidity pools paired with WBTC, cbBTC, BTCB and RBTC, so the attacker could extract only the real bitcoin-linked liquidity on the other side of those pools. Symbiosis's preliminary estimate puts the loss to liquidity providers and affected users at 9.97 BTC, about $770,000, which is the figure recorded here; the roughly $336,000 Blockaid saw the attacker realise from 4.39 WBTC through Uniswap v4 on Ethereum is kept as the low end of the range.

The team says it has secured about 15 BTC, some $1.15m, in a team-controlled multisig. The post-mortem describes it as bitcoin evacuated during the attack rather than coins taken back from the attacker, so it is not recorded as recovered. Symbiosis says it will cover the losses from part of that bitcoin and from separate compensation arrangements, and is contacting affected liquidity providers directly, but it has not published the criteria or a timetable. A 20% white-hat bounty offered to the attacker expired on 13 September, and the same 20% now applies to information that leads to recovery. Only the Bitcoin bridge was affected; it remains offline while its code is rewritten and independently audited, and Bitcoin swaps run through partner routes in the meantime.