Synthetic Bitcoin Bug Exposes Vulnerability in Cross-Chain Bridges
A recent bug in Symbiosis' Bitcoin bridge allowed an attacker to mint over 46.1 billion synthetic Bitcoin tokens, a staggering figure that far exceeds the total supply of real Bitcoin, which is capped at 21 million coins.
The incident occurred on September 11, 2026, when the BridgeV2 contract on BNB Chain accepted a bad message, instructing it to mint syBTC without the matching Bitcoin behind it. Despite this enormous creation of synthetic assets, the attacker only managed to cash out around $336,000 by selling about 4.39 WBTC on Ethereum through Uniswap V4.
Symbiosis moved quickly to contain the damage, halting BTC routes and recovering about 15 BTC that had been compromised. The team also offered a white-hat reward of 20% of the funds to anyone who could provide information leading to recovery, with the deadline set for September 13, 2026.