Symbiosis has halted bitcoin bridge routes after an attacker exploited its BTC Bridge and minted a huge amount of unbacked synthetic bitcoin, according to statements from the project and blockchain security firm Blockaid.
Blockaid said the attacker used the issue to mint about 2^62 raw syBTC, which has 8 decimals and a face value of roughly 46.1 billion. Despite that eye-catching figure, the realized proceeds reported so far were far smaller: about $336,000 in WBTC after part of the minted balance was sold.
Attack disclosed after early Sep. 11 incident
Symbiosis said the security incident took place at approximately 04:28 UTC on Sep. 11, 2026. In a public update, the team said an attacker exploited a vulnerability in its bitcoin bridge, prompting it to stop BTC routes while leaving other routes operational.
The project said other routes remain safe. It also stated that about 15 BTC had been recovered and moved to a team-controlled multisig. No broader final loss figure was included in the public update cited in the source material.
Blockaid traced minting and cash-out activity
Blockaid described the event as a bridge mint issue in which a signed BridgeV2 receive resulted in roughly 2^62 raw syBTC being minted to a fresh externally owned account. The same beneficiary then sold around 4.39 WBTC on Ethereum's Uniswap v4, according to the firm's post.
The source article characterized the exploit as a case in which the attacker induced the system to create synthetic BTC that was not backed by real bitcoin. Most of that minted supply appears to have had little practical value, with only a small portion converted into real wrapped bitcoin proceeds.
Project offers bounty to attacker
Symbiosis said it has contacted the attacker with a white-hat proposal. The offer is for 20% of the funds and remains open until Sep. 13, 2026, according to the team's statement.
The project added that after that deadline, the same 20% would be offered to anyone who provides information leading to recovery. As of the article's Sunday morning, Sep. 13 reference point, there was no public confirmation that the attacker had accepted the offer.
Latest in a string of bitcoin wrapper failures
The source article placed the Symbiosis incident alongside two other recent cases involving bitcoin-wrapping systems. It said the Liquid Network was drained for nearly 4,000 BTC using unbacked assets, and that Nomic also had a similar hole that reportedly went unnoticed for months.
While the article said the three cases were not identical in execution, it argued they shared the same broad failure mode: a bitcoin wrapper project being convinced to issue more tokenized bitcoin than it actually held in reserve.
What remains unresolved
As of Sunday morning, Sept. 13, Symbiosis had not published a technical post-mortem explaining exactly how BridgeV2 failed, according to the source article. It also had not disclosed a final dollar loss figure.
The next confirmed step from the team is limited to its current response: BTC routes remain halted, recovered funds are being held in a team-controlled multisig, and the white-hat bounty window runs through Sep. 13, 2026.
Source: news.bitcoin.com