Symbiosis Hack

At about 04:28 UTC on 11 September 2026, an attacker exploited Symbiosis's native Bitcoin Bridge. With a Bitcoin deposit of only 330 satoshis (about $0.25), the attacker minted about 46.1 billion unbacked syBTC through 12 fake deposits on BNB Chain, Ethereum and Rootstock, all within about four minutes. According to Symbiosis's post-mortem as reported by KuCoin News, two bugs in the bridge were combined.

The bridge read the wrong part of the Bitcoin transaction to identify the payer, which gave the attacker depositor and administrator rights. It also mishandled a negative minimum fee, so deducting the fee increased the deposit instead. The attacker turned about 4.39 WBTC of the proceeds into roughly $336,000 on Uniswap.

Symbiosis's preliminary estimate of losses to liquidity providers and users was 9.97 BTC, about $770,000. Symbiosis halted BTC routes while keeping other routes running, and secured about 15 BTC in a team-controlled multisig. It offered the attacker a 20% white-hat bounty until 13 September, and after that the same 20% for information leading to recovery.

Symbiosis also announced compensation for affected liquidity providers and said the native bridge would stay off until a full software rewrite had passed an independent external audit.