Symbiosis Recovers 15 BTC After Bitcoin Bridge Exploit, Offers 20% Bounty
Cross-chain protocol Symbiosis recovered about 15 BTC from a Sept. 11 exploit that minted billions of unbacked synthetic bitcoin, and offered the attacker a 20% bounty, while liquidity providers await a compensation plan.
Cross-chain liquidity protocol Symbiosis said it recovered approximately 15 BTC after an attacker exploited a vulnerability in its Bitcoin Bridge on Sept. 11. The bitcoin, worth roughly $1.15 million, is now held in a team-controlled multisig wallet.
The exploit occurred at approximately 04:28 UTC on Sept. 11. Blockchain security firm Blockaid said it detected an exploit on BNB Chain in which a call to Symbiosis's BridgeV2 contract minted roughly 46.1 billion syBTC, the protocol's synthetic bitcoin token, and sent the tokens to a fresh address. The quantity is more than 2,000 times bitcoin's maximum 21 million coin supply.
The gap between the minted tokens and the actual funds extracted is large. Blockaid said the attacker sold only approximately 4.39 WBTC through Uniswap v4 on Ethereum, realizing about $336,000 in proceeds. DeFiLlama classified the incident as an "unbacked cross-chain mint" with a $336,000 loss.
Symbiosis halted its native bitcoin routes and isolated the affected bridge from the rest of its infrastructure. Other routes across EVM networks, TRON, and TON, as well as its Octopools product, remained operational, according to the protocol. Symbiosis has since restored bitcoin swaps through third-party partners Chainflip and THORChain, though its own Bitcoin Bridge stays paused.
The bounty and what remains unresolved
Symbiosis offered the attacker a white-hat bounty equal to 20% of the funds, valid through Sept. 13. After that window closed, the protocol said the same 20% reward would shift to anyone who provides information leading to further recovery. As of Sept. 14, there was no public confirmation that the attacker accepted the offer.
"We are contacting every affected LP directly," Symbiosis wrote. "We are building a compensation framework and will publish the criteria shortly." The protocol said the final loss figure is still being calculated.
The incident comes less than a week after an attacker exploited a separate bug in Blockstream's Liquid Network to create roughly 4,000 unbacked LBTC, redeeming them for bitcoin held by the network. Blockstream later refused a ransom demand for the approximately 598.5 BTC still outstanding.
Symbiosis says it has facilitated more than $10 billion in transaction volume since launching about five years ago. The protocol currently has roughly $7 million in total value locked, per DefiLlama data. Bitcoin itself was not compromised in the exploit.