Bridge mints fake BTC
The Cryptonomist says the attacker minted roughly 46.1 billion fake syBTC tokens, while Blockaid’s analysis described a suspicious call to Symbiosis’s BridgeV2 contract on BNB Chain that triggered a signed “receive” function.T
Despite the scale of the mint, the attacker’s realized cash-out was far smaller, with Blockaid estimating about 4.39 wrapped bitcoin sold through Uniswap, netting roughly $336,000.
Symbiosis moved to contain the fallout by isolating the compromised system, suspending native Bitcoin routing while keeping other cross-chain rails running, and it later said it recovered around 15 BTC into a team-controlled multisignature wallet.
The protocol’s own account of the incident placed the breach at roughly 04:28 UTC on September 11, 2026, according to The Cryptonomist.T
Bounty and liquidity limits
Symbiosis said it recovered 15 Bitcoin (BTC) into a team-controlled multi-sig wallet and clarified that all routes remain operational, while the exploit affected its native Bitcoin bridge, which remains paused, according to TradingView.
TradingView also reported that the attacker’s address minted 46.1 billion unbacked tokens but realized net proceeds of 4.3 Wrapped Bitcoin (WBTC), worth $336,000, according to Blockaid.
Symbiosis offered a 20% bounty to anyone who provides information that leads to asset recovery, and TradingView said the protocol initially offered a 20% white-hat bounty for the attacker to return the funds but the deadline expired on Sunday.
The Cryptonomist described how liquidity constraints capped the damage, saying the attacker managed to offload only about 4.39 wrapped bitcoin through Uniswap v4 on Ethereum, realizing roughly $336,000 in proceeds.T
As of the reporting, Symbiosis had not published a full technical post-mortem explaining how BridgeV2 was bypassed, leaving the precise mechanics of the exploit undisclosed for now, according to The Cryptonomist.T
What’s at stake next
The Cryptonomist said Symbiosis was still working with security researchers to assess the full impact before bringing the native route back online, and it noted that the protocol suspended native Bitcoin routing while keeping other cross-chain rails running.T
CryptoRank framed the immediate stakes for users by saying affected liquidity providers still lacked compensation terms as a Sep. 13 bounty window neared its unspecified cutoff.
CryptoRank also reported that Symbiosis said final accounting remained in progress and that it would publish confirmed figures in another update, while Blockaid’s estimate of about $336,000 covered value the attacker converted rather than a final loss tally.
Across the broader DeFi landscape, The Cryptonomist described the incident as part of a pattern of bridge pressure points, and it said the breach hit Symbiosis’s Bitcoin Bridge at roughly 04:28 UTC on September 11, 2026 while other routes across EVM-compatible chains, TRON and TON stayed operational throughout.T