Symbiosis Bitcoin Bridge Exploit Mints Billions of Unbacked syBTC

Symbiosis’s Bitcoin bridge was compromised on September 11, 2026, when an attacker leveraged a vulnerability in BridgeV2 to mint an enormous amount of unbacked synthetic BTC (syBTC). The on‑chain security firm Blockaid reported that the exploit created approximately 2^62 raw syBTC, equivalent to a face value of about $46.1 billion, which was sent to a fresh external address.

How the Attack Unfolded

The malicious actor quickly dumped a small portion of the minted tokens, converting roughly 4.39 WBTC on Ethereum’s Uni V4 for an estimated $336 k in real assets. The remaining synthetic supply could not be sold because it lacked any backing.

Symbiosis’ Response

Symbiosis announced the incident on X, confirming that BTC routes were halted while other bridge routes remained operational. The team secured approximately 15 BTC on a multisig wallet and offered a white‑hat bounty of 20 % of the recovered funds. The bounty window closed on September 13, 2026, after which the same reward would be available to anyone providing actionable information.

Pattern of Similar Hacks

This exploit follows two recent incidents involving bitcoin‑backed wrappers:

• The Liquid Network suffered a drain of nearly 4,000 BTC through unbacked assets.
• Nomic’s nBTC wrapper experienced a prolonged vulnerability that allowed extra tokens to be minted.

All three cases share a common flaw: the ability to create synthetic bitcoin tokens without the required collateral.

Current Status

As of September 13, Symbiosis has not released a detailed technical post‑mortem, nor has it confirmed whether the attacker accepted the bounty offer. The full financial impact beyond the $336 k realized proceeds remains unclear.