Symbiosis's Bitcoin Bridge minted 46 billion syBTC from a 25-cent deposit. Real losses were about 9.97 BTC

What happened

The headline number is absurd on purpose. On 11 September 2026, an attacker deposited 330 satoshi into Symbiosis's native Bitcoin Bridge, about 25 cents, and walked away with the ability to mint roughly 46.1 billion syBTC. That is far more than the 21 million bitcoin that will ever exist.

The attacker could not spend most of it. Symbiosis's post-mortem puts the preliminary losses to liquidity providers and affected users at 9.97 BTC, about $770,000. The bridge's native Bitcoin route was halted and is being rewritten.

What is confirmed

Symbiosis published its post-mortem a few days after the attack. We found no copy we could verify on Symbiosis's own domain, so we rely on its description as reported by CoinDesk, BlockSec, CoinPost and others, and we do not link them. Details are consistent across those reports.

• When and how. 11 September 2026. Twelve bogus deposits across BNB Chain, Ethereum and Rootstock, over about four minutes.
• First flaw. The bridge misread sender information in Bitcoin transactions. The attacker could make it look as though they were both an approved depositor and the bridge administrator.
• Second flaw. That access allowed a negative minimum fee to be set. A second bug then added that negative fee to the deposit instead of subtracting it, so the credited amount became arbitrary.
• What was cashed out. The attacker converted about 4.39 WBTC through Uniswap v4 for roughly $336,000, according to the reporting.
• Losses. Symbiosis's preliminary estimate is 9.97 BTC, about $770,000, for liquidity providers and affected users.
• Response. Symbiosis halted the native Bitcoin Bridge. It says it will rewrite and independently audit the Bitcoin-side software, use some Bitcoin that was moved out of harm's way during the attack, and arrange separate compensation. Reporting puts the amount secured at roughly 15.2 BTC. We found that in only one report.

How it worked

A bridge for Bitcoin has an awkward job. It watches Bitcoin transactions and must decide who really sent them, how much, and what to credit on the other chains. Everything it believes about a deposit comes from data an outside party wrote.

According to Symbiosis, the bridge took information about the depositor from parts of a Bitcoin transaction that the spender controls. That let the attacker pose as someone with special rights, including the administrator.

Special rights opened a door the attacker could not otherwise reach: setting a fee. A fee should never be negative. The software did not check. Worse, a second bug applied the fee with the wrong sign, so a negative fee made the credited amount bigger. A tiny deposit could be recorded as enormous.

Neither flaw alone would have mattered much. One let a stranger look like an admin. The other turned an admin setting into free money.

The huge number did not mean huge theft. The new syBTC was only worth what the pools on the other side could pay for it. Liquidity was thin, so the attacker could drain only what was available, which is why the dollar loss was thousands of times smaller than the face value.

What is not known

• Who the attacker is.
• The final loss figure. Symbiosis calls its number preliminary.
• How and when liquidity providers will be compensated.
• When the native Bitcoin route will return, and what the audit will cover.
• Whether other routes or chains were exposed. Symbiosis's reported statements concern the native Bitcoin Bridge.

Where sources disagree

There is little real disagreement. Outlets differ on the loss: some quote the attacker's roughly $336,000 sale, others the $770,000 or 9.97 BTC loss estimate. These measure different things, what the attacker converted versus what LPs and users lost. A few headlines quote the 46.1 billion face value, which is not a loss figure.

Lessons

• Never read identity from data the sender controls. Identity needs a signature or a check against something the sender cannot write.
• Validate settings, including signs. A negative fee should be rejected at the door, and again where it is applied.
• Cap mints. A per-transaction or per-hour mint limit would have turned a catastrophic bug into a nuisance.
• Liquidity is a firebreak, not a plan. The small loss here came from thin markets, not from design.
• Treat admin paths as attack surface. If a stranger can look like an admin, admin settings are public.

What users should do

If you provided liquidity to Symbiosis's Bitcoin routes or held syBTC, follow Symbiosis's official announcements for the claims process. Do not trust direct messages offering compensation or asking you to connect a wallet.

If you bridge Bitcoin to other chains, check whether the bridge you use has a mint cap and whether it publishes an audit of its Bitcoin-side software.

Sources: Symbiosis's post-mortem as reported by CoinDesk, BlockSec, CoinPost and KuCoin News. We could not verify a primary copy and have not checked the on-chain data ourselves.