On September 11, the Symbiosis Bitcoin Bridge experienced a security breach in its BridgeV2 smart contract on the BNB Chain. An attacker exploited a vulnerability to mint 46.1 billion syBTC tokens without any underlying collateral. While the notional value of these tokens exceeded 2,000 times the total circulating supply of Bitcoin, the actual financial impact was limited by liquidity pool constraints.
The hacker liquidated approximately 4.39 WBTC via Uniswap v4 on Ethereum, resulting in realized proceeds of about $336,000. Security firm Blockaid identified the unauthorized minting activity, prompting the Symbiosis team to confirm the exploit by 04:28 UTC on September 11. The protocol immediately halted all native Bitcoin bridge routes to contain the incident.
Symbiosis recovered approximately 15 BTC from a multisig wallet and proposed a 20% bounty to the attacker for the return of funds, with a deadline of September 13. As of mid-September, the project has not issued a formal technical post-mortem. Native bridge operations remain paused, with cross-chain swaps currently redirected through partners including Chainflip and THORChain.
