Skip to content
THREATWIRE

Index

Search

Search the public record. Drafts and scheduled notes are not included.

High

defi

Symbiosis's Bitcoin Bridge minted 46 billion syBTC from a 25-cent deposit. Real losses were about 9.97 BTC

On 11 September 2026 an attacker used two flaws in Symbiosis's native Bitcoin Bridge to mint about 46.1 billion unbacked syBTC from a 330-satoshi deposit. Symbiosis's post-mortem puts losses to liquidity providers and users at 9.97 BTC, about $770,000. The bridge is offline for a rewrite and audit.

Published 3h ago

Medium

defi

Unbacked mints: five 2026 incidents, one question the code forgot to ask

Liquid, NEAR Intents, Meter, Symbiosis and Payy failed in different ways this autumn. In each, the system created a claim on real money without checking that real money stood behind it. A look at the common pattern, drawn from the projects' own accounts, and the controls that would have limited it.

Published 3h ago

High

defi

Meter's Passport bridge minted about $2.3M of unbacked tokens, then the chain was paused

On 23 September 2026 an attacker minted unbacked wrapped MTRG through Meter Passport and sold part of it on PancakeSwap, crashing MTR and MTRG. Meter blamed a block validation flaw, paused its chain and bridge, and has not published a full post-mortem. It is the project's second bridge incident.

Published 4h ago

High

defi

Payy's bridge paid out $1.9M after its verifier accepted a forged proof

On 24 September 2026 Payy's Ethereum bridge released about 1.92M USDC against a burn that never happened. Payy's post-mortem says an invalid proof got through its Noir and Barretenberg verifier. The network was paused, and a user claims process has been promised but not yet published.

Published 4h ago

High

defi

Hemi lost 124.5M unclaimed HEMI to a claim contract bug, says its post-mortem

Hemi says an attacker drained about 124.5 million unclaimed HEMI from its legacy Genesis Drop claim contract on 7 September 2026 by calling back into the contract before it updated its balances. The tokens sold for about $255,000. HEMI, veHEMI and bridges were not affected.

Published 4h ago