The Symbiosis DeFi exchange suffered a security breach resulting in a loss of $770 000. An attacker exploited a vulnerability in a smart contract that lacked basic bounds checking for transaction fees.
By gaining unauthorized administrative privileges, the hacker set transaction fees to a negative value. This allowed the attacker to generate 46 billion syBTC tokens while spending only 330 satoshi, equivalent to approximately $0.25.
The attacker sold the unbacked syBTC tokens against various wrapped BTC pairs, including BTCB, cbBTC, WBTC, and RBTC. Approximately $336 000 was successfully converted into cash via Uniswap before the remaining tokens were flagged by security firms.
Symbiosis plans to compensate liquidity providers through individual repayment plans, potentially involving debt packages or IOUs. The project is currently rewriting its Bitcoin-side logic and has requested an independent audit of its entire system.
