Key Takeaways
- Symbiosis watched billions in fake syBTC get minted, yet the hacker walked away with just $336,000.
- Symbiosis clawed back 15 BTC and put a 20% bounty on the table, with its Sept. 13 deadline looming.
- Liquid, Nomic and Symbiosis have now been burned by similar backing failures in a matter of weeks.
Bitcoin Bridge Exploit Mints Billions in Unbacked syBTC
This week, the onchain cybersecurity platform Blockaid discovered an issue with Symbiosis’s BTC Bridge. “Community alert,” Blockaid wrote on the social media platform X. “Signed BridgeV2 receive minted ~2^62 raw syBTC (8 decimals; face value ~46.1B) to a fresh EOA; same beneficiary dumped ~4.39 WBTC on Ethereum Uni V4. ~$336k realized WBTC proceeds so far.”
Put simply, the hacker tricked Symbiosis’s bitcoin bridge into creating a massive amount of unbacked synthetic BTC. However, the malicious entity only managed to sell a sliver of it for about $336,000 in real wrapped bitcoin (WBTC); the rest was a phony supply nobody would buy. Symbiosis also confirmed the attack on X.
Symbiosis Recovers 15 BTC and Offers Hacker a 20% Bounty
“Symbiosis experienced a security incident. At approximately 04:28 UTC on Sep 11, 2026, [an] attacker exploited a vulnerability in bitcoin bridge. BTC routes have been halted. Other routes remain operational and safe,” the team disclosed. The team has recovered approximately 15 BTC, now secured on a team-controlled multisig.”
Symbiosis added:
“We have contacted the attacker with a white-hat bounty offer of 20% of the funds, open until Sep 13, 2026. After that window, the same 20% will be offered to anyone providing information that leads to recovery.”
Liquid, Nomic, and Symbiosis Hit by the Same Basic Trick
What makes this incident worse is that this basic unbacking trick has happened three times over the last few weeks. While they are not exactly the same maneuvers, the Liquid Network was drained for nearly 4,000 BTC using unbacked assets, and similarly, Nomic had a hole that went unnoticed for months under similar circumstances.
All three incidents did the same basic trick. Essentially, they all convinced a bitcoin wrapper project to print extra coins that were supposed to stand for real tokens. As of Sunday morning, Sept. 13, Symbiosis still had no public technical post-mortem explaining exactly where BridgeV2 failed, no final dollar loss figure, and no public confirmation that the attacker accepted its 20% white-hat offer.
‘Return the Bitcoin’: Blockstream Draws Line After 4,000 BTC Hack
A group that drained nearly 4,000 BTC from Blockstream’s Liquid Network returned 3,400 BTC, kept about 598.5 BTC, demanded a…
‘Return the Bitcoin’: Blockstream Draws Line After 4,000 BTC Hack
A group that drained nearly 4,000 BTC from Blockstream’s Liquid Network returned 3,400 BTC, kept about 598.5 BTC, demanded a…
‘Return the Bitcoin’: Blockstream Draws Line After 4,000 BTC Hack
A group that drained nearly 4,000 BTC from Blockstream’s Liquid Network returned 3,400 BTC, kept about 598.5 BTC, demanded a…
