On September 11, 2026, the Symbiosis cross-chain protocol suffered a security breach in its BridgeV2 contract. An attacker exploited a vulnerability to mint unbacked syBTC tokens with a notional value of $46.1 billion. The actual financial loss amounted to approximately $336,000 after the attacker converted 4.39 WBTC on Uniswap V4.
The security firm Blockaid detected the suspicious activity, allowing the team to halt BTC-related routing. As of September 13, the Bitcoin Bridge remained offline with no announced restart date. Other cross-chain routes continue to operate normally.
Symbiosis successfully recovered 15 BTC, which are currently held in a multisig wallet. The protocol has offered the attacker a 20% bounty for the return of funds, with a deadline of September 13, 2026. If the offer is ignored, the reward will be redirected to individuals providing information for further recovery.
The team is currently finalizing loss calculations and contacting affected liquidity providers to establish a compensation framework. Previously, the protocol had undergone audits by firms including Decurity, Zokyo, SlowMist, and Omniscia.
