Cross-chain liquidity protocol Symbiosis has recovered approximately 15 BTC after an attacker exploited its Bitcoin Bridge on September 11, 2026. According to reports from Blockaid, the exploit resulted in the minting of roughly 46.1 billion unbacked syBTC tokens, which represented synthetic tokens created through the affected bridge contract rather than newly created Bitcoin on the Bitcoin network. The breach was discovered at approximately 04:28 UTC and exploited a vulnerability in Symbiosis' BridgeV2 contract. The flaw allowed the attacker to mint an almost incomprehensibly large quantity of unbacked syBTC tokens, approximately 2^62 raw units, with a notional face value of around $46.1 billion. However, the actual damage was far more contained: the attacker converted only around 4.39 WBTC through Uniswap v4 on Ethereum, generating approximately $336,000 in proceeds, as reported by DeFiLlama. Odaily Planet Daily confirms that the on-chain security firm Blockaid identified the suspicious activity before Symbiosis made any public announcement, which helped compress the window for further extraction.
The attack utilized two critical software bugs in Symbiosis' Bitcoin Bridge that combined to enable massive token creation. As reported by CoinDesk, the bridge looked at the wrong part of a bitcoin transaction when deciding who had sent the money, allowing the attacker to persuade the system to treat them as both an approved depositor and the bridge administrator. This elevated access let the attacker push the bridge's minimum fee below zero, a second bug then subtracted the negative fee from the deposit amount, which added to it rather than reducing it - meaning the deposit could suddenly be treated as worth essentially whatever number the attacker supplied. The attacker processed 12 bogus deposits across BNB Chain, Ethereum and Rootstock in roughly four minutes, eventually creating about 46.1 billion syBTC, or more than 2,000 times Bitcoin's 21 million coin limit. Symbiosis said syBTC supply stood at just 13.91 tokens before the attack, with 11.26 syBTC sitting in liquidity pools paired with WBTC, cbBTC, BTCB and RBTC.
The recovered bitcoin has been moved to a team-controlled multisig wallet, with the protocol offering a 20% bounty for further fund recovery. As reported by Symbiosis, the initial white-hat bounty was offered to the attacker until September 13, 2026, with the same percentage subsequently available to anyone providing information leading to additional asset recovery. The exploit was limited to Symbiosis' native Bitcoin Bridge, while routes involving EVM networks, TRON and TON continued to operate, along with the Octopools product and relayer network. Bitcoin swaps have since resumed through third-party integrations with Chainflip and THORChain while the protocol's own bridge remains offline. The multisig arrangement requires multiple private keys to authorize any transaction, meaning no single party can unilaterally move the recovered funds while negotiations with the attacker were still live. As of September 13, 2026, Symbiosis had not received a confirmed public response from the attacker, with the team noting that final loss calculations were still being finalized. However, several key details remain unresolved, including the absence of published recovery transaction hashes, multisig addresses, or attacker addresses, meaning the recovery claim cannot be independently verified through block explorers.
According to DeFiLlama data, Symbiosis had processed more than $10 billion in transactions since launching roughly five years ago, with total value locked at around $7 million and recorded bridge volume at approximately $3.19 billion since the data series began. The protocol has not disclosed a final loss figure, stating that accounting work is still underway as it contacts affected liquidity providers. Affected LPs are being contacted directly, with a compensation framework under preparation and eligibility criteria expected to be released separately. The $336,000 in realized losses illustrates how the ceiling on actual damage is set by available liquidity, with the notional exposure of $46.1 billion showing how catastrophic a BridgeV2-class vulnerability could be against deeper liquidity pools. Symbiosis initially said Bitcoin-related swaps were unavailable while it deployed updates, but in a later operational update, the protocol confirmed that Bitcoin swaps routed through partners Chainflip and THORChain were back online, while the native Symbiosis Bitcoin Bridge remained paused. The distinction determines what users can access, with partner-routed Bitcoin swaps available but the affected bridge still paused.
The incident follows similar bridge exploits in the cryptocurrency space, including a separate Bitcoin-linked bridge incident on Blockstream's Liquid Network that produced approximately 4,000 unbacked L-BTC before recovery efforts. As reported by crypto.news, another case in April involved Hyperbridge's cross-chain gateway, where an attacker minted roughly 1 billion unauthorized DOT-equivalent tokens before extracting around $237,000. The Sandbox incident in August saw approximately 14.75 million Ethereum-backed SAND minted, with token sales generating roughly $675,000. What makes this incident particularly concerning is that it represents the third major Bitcoin bridge exploit in recent weeks, following similar incidents on the Liquid Network and Nomic platform. All three incidents involved the same basic unbacking trick, where attackers convinced Bitcoin wrapper projects to print extra coins that were supposed to stand for real tokens, demonstrating a systematic vulnerability in cross-chain bridge infrastructure. Affected liquidity providers are now waiting for three disclosures: confirmed loss and exposure figures, compensation criteria, and any change to the native bridge's status. Until Symbiosis publishes that information, the recovered funds and Blockaid's proceeds estimate should not be treated as a final loss tally.
