Hacker Exploits Symbiosis Bridge to Mint 46 Billion Fake Bitcoin Tokens with 25-Cent Deposit
A 330-Satoshi Deposit Unlocks Massive Token Creation
A hacker used just 330 satoshi, worth about 25 cents, to create over 46 billion fake bitcoin-linked tokens on a decentralized finance (DeFi) bridge service called Symbiosis. DeFi bridges allow users to swap tokens between different blockchains.
The attack exploited two software bugs in Symbiosis' Bitcoin Bridge, which is designed to handle tokens representing real bitcoin. Blockchain data shows the hacker processed 12 bogus deposits across BNB Chain, Ethereum, and Rootstock in roughly four minutes.
How the Exploit Worked and Its Scale
- The attacker deposited 330 satoshi and created approximately 46.1 billion syBTC tokens, which are meant to be backed by real bitcoin.
- This amount is more than 2,000 times Bitcoin's maximum supply of 21 million coins.
- The exploit relied on two bugs: one that granted administrator privileges by looking at the wrong part of a transaction, and another that treated a negative fee as an addition, allowing arbitrary token creation.
- Symbiosis estimates the preliminary loss at 9.97 BTC, or about $770,000, affecting liquidity providers and users.
Symbiosis' Detailed Post-Mortem
Symbiosis published a post-mortem explaining the flaws. The bridge incorrectly validated depositors, letting the attacker pose as both an approved depositor and the bridge administrator. This elevated access allowed setting the minimum fee below zero. A second bug then subtracted this negative fee from the deposit amount, effectively adding to it instead of reducing it.
Before the attack, syBTC supply was just 13.91 tokens, with 11.26 syBTC in liquidity pools paired with other bitcoin-related tokens. The loss figure is lower than the tokens minted because unbacked bridge tokens cannot be redeemed for real assets beyond what was available in liquidity pools.
Blockchain Evidence and Context
CoinDesk reviewed blockchain data confirming the 12 bogus deposits and the creation of 46.1 billion syBTC. Symbiosis' Bitcoin Bridge currently holds about $8 million in total value locked, according to DefiLlama, despite processing roughly $146 million in bridge volume over the past 30 days.
Verified Facts from the Incident
- The hacker started with a 330-satoshi deposit (approximately $0.25).
- 46.1 billion syBTC tokens were minted through 12 deposits.
- Two specific software bugs in the Symbiosis bridge were exploited.
- Preliminary losses are estimated at 9.97 BTC.
- The bridge has been taken offline for a rewrite and an independent audit.
Impact on Liquidity and DeFi Security
This incident highlights risks in DeFi bridges, where software bugs can lead to significant losses. Liquidity providers, who supply assets to enable swaps, are directly affected. The event underscores the importance of thorough code audits and security measures in decentralized systems.
Symbiosis Plans for Recovery and Prevention
Symbiosis has pledged to compensate affected users and cover the stolen funds using some bitcoin evacuated during the attack and separate compensation arrangements. The bridge is offline while the team rewrites the code and undergoes an independent audit to prevent future exploits.
