Crypto14 September, 20262 min read
Hacker Mints 46.1 Billion Fake SyBTC on Symbiosis BridgeV2, Then Cashes Out $336,000
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Two software flaws in BridgeV2 minted 46.1 billion unbacked syBTC from 25-cent BTC The attacker withdrew about $336,000 in unbacked assets
BridgeV2 minted fake syBTC
A hacker exploited Symbiosis’s BridgeV2 smart contract on BNB Chain at about 04:28 UTC on September 11, 2026, minting approximately 46.1 billion unbacked syBTC tokens without the matching Bitcoin behind them. Blockaid said the signed BridgeV2 call minted “~2^62 unprocessed syBTC (8 decimals; nominal value ~46,100 million)” into a new EOA account, and the same beneficiary then sold “~4.39 WBTC on Ethereum Uni V4.” Symbiosis later said it had recovered about 15 BTC, while its native Bitcoin bridge routes were halted and other routes remained operational and secure.
The attacker’s realized proceeds were about $336,000 after exchanging only about 4.39 WBTC via Uniswap on Ethereum, leaving the remaining minted syBTC with no market demand. Blockaid’s monitoring and Symbiosis’s subsequent confirmation framed the incident as a cross-chain “unbacking” failure affecting Liquid, Nomic, and Symbiosis within weeks, according to the reporting.
Bounty window and quotes
Symbiosis offered a white-hat reward equal to 20% of the funds and set a deadline of September 13, 2026, for the attacker to return the remaining assets.
In its statement on X, Symbiosis said, “Approximately at 04:28 UTC on September 11, 2026, the attacker exploited a vulnerability in the Bitcoin bridge,” and added that “BTC routes have been disrupted. The other routes remain operational and secure.”
Blockaid had already urged immediate action on X with “Alert the community,” after observing the abnormal BridgeV2 minting and subsequent WBTC sale.
Cointelegraph reported that Symbiosis’s initial 20% white-hat offer was rejected by the hacker and that the protocol then shifted to offering the same 20% bounty to anyone providing information leading to asset recovery.
As of September 13, multiple outlets noted Symbiosis had not yet published a full technical analysis explaining exactly where BridgeV2 failed, while the protocol continued contacting impacted liquidity providers.
Liquidity providers await terms
The exploit’s scale and the realized cash-out diverged sharply, with Blockaid describing a nominal value of about 46,100 million syBTC while the attacker’s observed proceeds were about $336,000. CryptoRank said affected liquidity providers still lacked compensation terms as a September 13 bounty window neared its cutoff, and it described Symbiosis’s recovered 15 BTC as only the amount recovered “to date.” Blockaid’s analysis and the broader reporting emphasized that Symbiosis’s native Bitcoin bridge remained paused while Bitcoin swaps resumed through third-party integrations with Chainflip and THORChain.
Blockonomi reported that Symbiosis suspended native Bitcoin routing but kept operations for alternative routes spanning EVM-compatible blockchains, TRON, and TON, and said its Octopools service continued functioning without interruption. Until Symbiosis publishes confirmed loss and exposure figures and a compensation framework, the sources depict liquidity providers as waiting for disclosures about confirmed accounting and eligibility criteria.