Attacker Crashes Symbiosis Bridge with $25 Bitcoin Investment

An attacker exploited two software vulnerabilities on Symbiosis' Bitcoin Bridge service to mint approximately 46.1 billion fake syBTC tokens by depositing just 330 satoshis, or about 25 cents in Bitcoin.

The attack took place over four minutes and involved 12 fake deposit transactions on BNB Chain, Ethereum, and Rootstock.

The vulnerabilities allowed the attacker to present themselves as both an authorized investor and the bridge administrator, enabling them to set a negative minimum transaction fee and add it to the deposited amount instead of subtracting it.

This resulted in unbacked syBTC tokens being minted, with their value limited by the actual liquidity on the other side of the bridge. The circulating supply of syBTC before the attack was only 13.91 tokens, most of which were paired with various BTC tokens in liquidity pools.