Symbiosis Hack: Billions of Synthetic Bitcoin Created Out of Thin Air
A cross-chain protocol called Symbiosis was hacked on September 11, 2026, resulting in an attacker creating billions of synthetic units of syBTC out of thin air.
The hacker exploited a weakness in the BridgeV2 contract, which allows for message authentication. The attacker sent doctored reports to the contract across eight bridge transactions, causing it to believe them and mint new tokens without backing them with real Bitcoin.
The attack was immediately responded to by halting all BTC routing on Symbiosis while leaving remaining connections in service. The security of the protocol hangs on message verification, which was insufficient in this case.
A total of 46 to 369 billion syBTC were minted, but only a tiny fraction could be sold, with 4.39 WBTC being swapped through Uniswap V4 for around $336,000.