2026-09-11 · record inc_0012 · updated 2026-10-19
Symbiosis Bitcoin Bridge: 46.1 billion unbacked syBTC from a 330-satoshi deposit
Two flaws let an attacker pose as an administrator and set a negative fee; real losses were estimated at 9.97 BTC.
Symbiosis
BNB Chain
EthereumRootstockComponent: Native Bitcoin Bridge
- Event
- Independent analysis
- Root cause
- Independent analysis
- Loss
- Independent analysis
Current status
Bitcoin Bridge halted; rewrite and audit planned.
Timeline
- 2026-09-11Twelve bogus deposits across BNB Chain, Ethereum and Rootstock in about four minutes.
- 2026-09-15Post-mortem published, as reported.
Root cause
Per Symbiosis, the bridge took depositor identity from sender-controlled data, and a negative minimum fee was added instead of subtracted.
Basis: independent analysis · verified by us against that source
Classes: Bridge and cross-chain verification, Access control and caller trust
Impact: loss and recovery
Liquidity providers and users of the Bitcoin routes. Face value of minted tokens is not a loss.
Reported loss
$770K (9.97 BTC)
USD basis: Symbiosis preliminary estimate, via media.
Recovered or returned
15.2 BTC (partial)
About 15.2 BTC secured per one report. No dollar value assigned.
Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.
Addresses and transactions
No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.
Public reproduction file
No public reproduction file is recorded for this incident.
Remediation and defensive indicators
- Bridge halted; rewrite and independent audit planned. (reported)
Defensive lessons from the class
- Add an independent solvency check outside the minting path.
- Cap mints and withdrawals per period.
- Authenticate against addresses you control, never against the caller's own answer.
- Validate forwarded senders cryptographically.
Sources
Official post-mortem
Symbiosis: Bitcoin Bridge post-mortem
Published 2026-09-15 · retrieved 2026-10-19 · Primary copy not located; described via media and analysts.
Independent analysis
BlockSec: Liquid Network and Symbiosis exploits
retrieved 2026-10-19
Media report
CoinDesk: A 25-cent bitcoin deposit let a hacker mint 46 billion fake tokens
retrieved 2026-10-19
Media report
CoinPost: Symbiosis post-mortem details
retrieved 2026-10-19
Media report
KuCoin News: Symbiosis post-mortem summary
retrieved 2026-10-19
- Liquid Network: about 4,000 unbacked L-BTC through a proof-cache flawShared class: Bridge and cross-chain verification
- Meter Passport: unbacked wrapped MTRG minted through the bridgeShared class: Bridge and cross-chain verification
- Payy: a forged zero-knowledge proof accepted by the bridge verifierShared class: Bridge and cross-chain verification
Read the full written analysis
Method, uncertainty and corrections
Still unknown
- Final loss
- Compensation timing
Where sources disagree
- Loss quoted as $336K (attacker sale) or $770K (estimated loss).
Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
No corrections recorded since publication.