Symbiosis recovers 15 BTC after Bitcoin bridge exploit, offers attacker 20% bounty

On September 11, 2026, cross-chain protocol Symbiosis halted its native Bitcoin Bridge after an attacker exploited its BridgeV2 contract to mint 2^62 unbacked syBTC, theoretically worth $46.1 billion. Due to limited liquidity, the attacker only extracted $336,000 in real assets. Symbiosis recovered 15 BTC, secured them in a multisig wallet, and offered a 20% white-hat bounty. This incident mirrors a recent $320 million Liquid Network exploit, highlighting systemic risks in cross-chain infrastructure.

Symbiosis Bitcoin Bridge exploit

• ▪Symbiosis restored bitcoin swaps through third-party partners Chainflip and THORChain while its own native Bitcoin Bridge remained paused as of September 13, 2026
• ▪The on-chain security firm Blockaid identified the suspicious activity on the Symbiosis protocol before Symbiosis made any public announcement
• ▪Symbiosis discovered evidence of the Bitcoin Bridge attack on September 11, 2026, at approximately 04:28 UTC and immediately stopped BTC routing while keeping other cross-chain routes operational
• ▪The cross-chain liquidity protocol Symbiosis halted its native Bitcoin Bridge on September 11, 2026, after an attacker exploited a vulnerability in its BridgeV2 contract

Unbacked syBTC minting mechanism

• ▪The Delta Incident Archive classified the Symbiosis exploit as DCI-2026-304, noting that BridgeV2 processed an incorrect message that generated the unauthorized syBTC on BNB Chain and Ethereum
• ▪The attacker exploited the Symbiosis BridgeV2 contract to mint approximately 2^62 raw units of unbacked syBTC, which carried a theoretical notional face value of about $46.1 billion
• ▪The attacker converted a small portion of the unbacked syBTC into approximately 4.39 WBTC on Ethereum's Uniswap V4, realizing a profit of approximately $336,000

15 BTC recovery progress

• ▪Symbiosis announced it is contacting affected liquidity providers individually to establish a compensation framework following the Bitcoin Bridge exploit
• ▪Symbiosis recovered approximately 15 BTC, worth about $1.15 million, from the exploit and secured the funds in a team-controlled multisig wallet

20% white-hat bounty offer

• ▪As of September 13, 2026, Symbiosis had not received a confirmed public response from the attacker regarding the bounty offer
• ▪Symbiosis offered the attacker a 20% white-hat bounty on the recovered or returned funds, setting a claim deadline of September 13, 2026
• ▪Symbiosis stated that if the attacker did not claim the 20% bounty by September 13, 2026, the reward would be offered to anyone providing information leading to fund recovery

Cross-chain bridge vulnerability pattern

• ▪In April 2026, an attacker exploited the Polkadot-focused Hyperbridge to mint 1 billion bridged DOT but was only able to extract approximately $237,000 in actual value
• ▪The Bank Policy Institute analyzed a separate hack of KelpDAO, showing that unbacked rsETH generated from poor cross-chain validation caused $5 billion in stablecoin withdrawals and raised borrowing rates on Aave to 10%
• ▪Prior to the September 11, 2026 exploit, Symbiosis had operated on mainnet for several years with a clean audit history, including audits by Decurity, Zokyo, SlowMist, and Omniscia

Liquid Network hack comparison

• ▪The Symbiosis exploit occurred less than a week after an attacker exploited a transaction-validation proof vulnerability on Blockstream's Liquid Network to mint 4,000 unbacked LBTC
• ▪The Liquid Network attacker returned approximately 3,400 BTC, but Blockstream refused the attacker's demand for a bounty on the remaining 598.5 BTC

Debatable claims

• ▪Symbiosis was right to offer a 20% bounty to its attacker
• ▪Smart contract audits provide a false sense of security for DeFi protocols
• ▪Cross-chain bridges pose an unacceptable security risk to the DeFi ecosystem