Attacker Mints 46.1 Billion Fake syBTC on Symbiosis Bridge, Walks Away With Just $336K

An attacker printed more than 2,000 times Bitcoin's entire supply in fake BTC, and cashed out less than the price of a one-bedroom condo.

Three key facts

At around 04:28 UTC on September 11, Symbiosis's Bitcoin bridge was breached and roughly 46.1 billion syBTC were minted from nothing. The bug sat in the BridgeV2 contract on BNB Chain, letting the attacker skip minting checks and issue the bridge's wrapped token, syBTC, at will.

Only about 4.39 WBTC, roughly $336,000, was actually extracted. The attacker dumped the fake tokens on Uniswap on Ethereum, but thin liquidity meant billions of counterfeit coins bought very few real ones. Symbiosis says it has recovered about 15 BTC, worth around $1.15 million, now held in a team-controlled multisig.

Symbiosis offered a 20% white-hat bounty with a September 13 deadline. After that, the same 20% goes to anyone whose intelligence helps recover funds. The team froze Bitcoin routes and isolated them from its EVM, TRON and TON routes, while Chainflip and THORChain handle Bitcoin swaps until the native bridge is fixed.

WangDou's Take

46.1 billion bitcoin, exchanged for $336K. It's like counterfeiting a trillion dollars, storming a corner store, and discovering there's $300 in the till. What saved Symbiosis wasn't an audit or a risk engine. It was a shallow pool.

The scary part: a cross-chain bridge shipped a mint function without a hard rule that says you can't issue more than what's locked. That's rule number one for bridges. This was a bank vault with no lock on the door that happened to sit on an empty street.

The 20% bounty with a three-day deadline is a script the industry has run a hundred times. Translation: keep what you took, just please give back the rest. Had the liquidity been deeper, today's headline would have had nine figures in it.

Source: Parameter · CoinCentral