Symbiosis Bridge Hit by Bitcoin Attack, Loses Between $336K and $750K

Symbiosis's Bitcoin bridge was exploited on September 11, resulting in losses estimated to be between $336,000 and $750,000. The attack occurred when an attacker sent a signed instruction that made the contract believe it had received Bitcoin that wasn't actually there.

The BridgeV2 contract, which allows native Bitcoin to move into Symbiosis as syBTC, was compromised. It uses an off-chain relayer network with MPC threshold keys to sign cross-chain messages, but in this case, it didn't properly validate the instruction and minted 46 billion tokens of syBTC.

The attacker moved some of these tokens to Ethereum and sold them on Uniswap V4 for about $336,000. The rest is still sitting in a BNB Chain wallet, worth an estimated 184.5 billion syBTC. This has no real backing and could cause further damage if it starts moving through liquidity pools.

Symbiosis confirmed the incident within an hour and disabled BTC-related swaps while keeping ETH and stablecoin routes live. They also offered a white hat reward of 20% of recovered funds to the attacker if they return the rest before September 13.