Symbiosis says it recovered 15 BTC after Bitcoin bridge exploit, offers attacker 20% bounty
Symbiosis says it recovered 15 BTC after Bitcoin bridge exploit
Cross-chain protocol Symbiosis said it recovered about 15 BTC after an attacker exploited its Bitcoin Bridge on Sept. 11.
A bridge is software that lets users move crypto assets from one blockchain network to another. Symbiosis has not shared further details about the vulnerability.
Key facts from Symbiosis
- Symbiosis said it recovered roughly 15 BTC, worth about $1.15 million at current prices, and is holding it in a team-controlled multisig wallet. Multisig means the wallet needs more than one key or approval to move funds.
- The protocol paused its own bitcoin routes and isolated the affected bridge from the rest of its infrastructure after the exploit.
- Bitcoin swaps are working again through third-party partners Chainflip and THORChain, but Symbiosis's own Bitcoin Bridge remains paused.
- Other routes on Ethereum-compatible networks, TRON and TON, and its Octopools product kept running.
Bounty offer and compensation plan
Symbiosis offered the attacker a white-hat bounty equal to 20% of the funds, available through Sept. 13. A white-hat bounty is a reward for returning stolen assets or reporting a vulnerability.
After that window closes, the protocol said it would offer the same 20% reward to anyone who provides information that leads to further recovery of funds.
Symbiosis said it is contacting every affected liquidity provider directly and building a compensation framework. Liquidity providers are users who supply funds to the protocol. The protocol said it would publish the criteria shortly.
Blockaid reported billions of unbacked syBTC
Blockchain security firm Blockaid said it found an exploit on BNB Chain. In the exploit, a call to Symbiosis's BridgeV2 contract minted about 46.1 billion syBTC and sent the tokens to a fresh address.
That amount is more than 2,000 times bitcoin's maximum supply of 21 million coins. Blockaid said the apparent attacker sold only about 4.39 WBTC — a token representing bitcoin on Ethereum — through Uniswap v4, realizing about $336,000 in proceeds.
DeFiLlama classified the incident as an "unbacked cross-chain mint" with a $336,000 loss. Unbacked means the tokens were created without real bitcoin behind them.
Recent bridge hacks followed a similar pattern
The incident came less than a week after an attacker used a bug in Blockstream's Liquid Network to create about 4,000 unbacked LBTC and redeem them for bitcoin held by the network. The attacker later returned about 3,400 BTC, but Blockstream refused a bounty demand for the roughly 598.5 BTC still outstanding, according to a previous The Block report.
In April, an attacker exploited Polkadot-focused Hyperbridge to mint 1 billion bridged DOT but ultimately netted only about $237,000.
What is supported and what is still unclear
Supported by the report: Symbiosis says it recovered about 15 BTC, the attack happened on Sept. 11, the recovered bitcoin is in a multisig wallet, and Blockaid reported the minting of about 46.1 billion syBTC.
Still unclear: Symbiosis did not provide details on the vulnerability. Blockaid reported about $336,000 in proceeds from the sale of 4.39 WBTC, and DeFiLlama classified the incident as a $336,000 loss. The full financial impact on Symbiosis is not stated in the source. The figures from Symbiosis, Blockaid and DeFiLlama are reported claims and have not been independently verified in the article.
Why this matters
Bridge exploits can affect funds that users have locked in a protocol while moving assets between networks. The Symbiosis case also shows a pattern seen in other bridge attacks this year: attackers mint large amounts of unbacked tokens, but can only sell a small fraction of them.
Symbiosis in numbers
Symbiosis says it has handled more than $10 billion in transaction volume since launching about five years ago. The protocol has about $7 million in total value locked, or assets deposited in the protocol, according to DeFiLlama data. It also has about $3.19 billion in bridge volume since its data series began.
What happens next
Symbiosis said it will publish the criteria for its compensation framework shortly. Its Bitcoin Bridge remains paused while it works through the process.
After Sept. 13, it also plans to offer a 20% reward for information that leads to further recovery of funds.