BTC Security

Symbiosis Claws Back 15 BTC After Bridge Catastrophe, Launches Public Bounty Hunt

2026-09-14

Cross-chain liquidity protocol Symbiosis has recovered roughly 15 Bitcoin—about $1.1 million at time of writing—after a smart contract exploit tanked its Bitcoin Bridge three days prior. The assets now sit in a multisig wallet the team controls. Standard practice, that.

The hack struck on 11 September 2026 at 04:28 UTC. The attacker found a vulnerability in Symbiosis's BridgeV2 contract and did what any sensible exploiter would: minted unbacked synthetic assets at stupidly vast scale. Blockchain security outfit Blockaid caught it and did the maths. The perpetrator conjured roughly 46.1 billion units of syBTC—the synthetic Bitcoin token. That's over 2,000 times Bitcoin's entire circulating supply, sitting in one address like a particularly stupid lottery win.

Here's where it gets funny. Despite controlling an obscene quantity of fake tokens, the attacker couldn't actually cash most of it out. Liquidity constraints are brutal. The hacker managed to liquidate only a sliver: roughly 4.39 Wrapped Bitcoin (WBTC) on Uniswap v4, netting about $336,000 in actual money. The gap between notional theft and realised proceeds is almost comical. Print 46 billion units, steal $336,000. This is why DeFi's plumbing matters more than its arithmetic.

Symbiosis opened with the standard gambit: a 20% white-hat bounty on stolen funds in exchange for return. Deadline: 13 September. The attacker ignored it. So the protocol pivoted. Same 20% bounty, now offered to any third party who tips off where more assets went. It's a public manhunt disguised as incentive alignment.

The protocol hasn't explained the relationship between the 15 BTC recovered and that $336,000 in realised proceeds. Perhaps one leads to the other, perhaps not. They've halted native Bitcoin routes—sensible move—but kept other cross-chain services running. EVM networks, TRON, TON: still operational. Bitcoin swaps now route through Chainflip and THORChain instead. Temporary workaround, obvious backstop.

Full damage remains unknown. Symbiosis hasn't published total losses yet and is contacting affected liquidity providers one by one to figure out compensation. They've promised confirmed loss figures and LP eligibility criteria in a future update. Slow, methodical, opaque—the typical post-exploit playbook.

This is the third major Bitcoin bridge unbacking attack in recent weeks. Back in May, the Verus-Ethereum bridge got drained of 5,402 Ether, worth roughly $11.6 million at the time. That attacker took a 25% white-hat bounty offer seriously: returned 75% of the loot, pocketed about 1,350 Ether—$2.8 million—and vanished like a professional. Not this one.

The pattern is instructive. Regulatory pressure and moral suasion push some attackers toward negotiation. Others reject bounties entirely and force protocols into adversarial recovery mode. It's not one playbook. It's a spectrum of greed and ego and risk tolerance playing out in real time. Bridge security remains broken. These incidents keep happening because the underlying design problems haven't been solved—just the individual vulnerabilities, one exploit at a time.

Source & further reading:

Sources