Symbiosis Recovers 15 BTC, but Its Native Bitcoin Bridge Is Still Paused

Symbiosis says it has recovered approximately 15 Bitcoin after an exploit hit its native Bitcoin Bridge, but the bridge itself remains paused while the project finishes its accounting and works through compensation for affected liquidity providers.

The incident is a sharp reminder that a Bitcoin-branded asset on another network is only as reliable as the bridge logic behind it. Bitcoin did not fail here.

A cross-chain system that represented Bitcoin did.

A huge synthetic mint met a much smaller pool of real liquidity

CryptoSlate reported that a faulty bridge message allowed an attacker to create an enormous quantity of unbacked syBTC on BNB Chain, exposing a validation failure in the cross-chain receive process rather than any change to Bitcoin’s underlying ledger. Security firm Blockaid described the mint as roughly 2^62 raw units and traced the beneficiary’s attempt to turn part of that synthetic balance into a liquid asset.

With eight decimal places, that represented about 46.1 billion synthetic Bitcoin—more than 2,000 times Bitcoin’s fixed 21 million supply.

That headline number was not the same thing as the amount the attacker could actually extract. Blockaid said the same beneficiary sold roughly 4.39 WBTC through Uniswap V4 and realized about $336,000 at the time of its alert.

The bridge’s available liquidity, not the fabricated token balance, placed the practical ceiling on the first cash-out.

The report said the attacker used the signed BridgeV2 receive path on BNB Chain, then moved value through WBTC liquidity on Ethereum. That cross-chain sequence matters because the fabricated syBTC supply did not become native Bitcoin simply by existing.

Only the portion that could find an exit into liquid assets became an immediate realized loss. The remaining unbacked units still exposed a severe validation failure, even though they could not all be sold at face value.

🚨Community alert: Blockaid detected an ongoing exploit on @symbiosis_fi on BSC.

Signed BridgeV2 receive minted ~2^62 raw syBTC (8 decimals; face value ~46.1B) to a fresh EOA; same beneficiary dumped ~4.39 WBTC on Ethereum Uni V4.

~$336k realized WBTC proceeds so far.

— Blockaid (@blockaid_) September 11, 2026

Symbiosis isolates the bridge and recovers 15 BTC

In its own incident update, Symbiosis said the attack began at approximately 04:28 UTC on September 11 and was confined to the native Bitcoin Bridge. The project said routes involving EVM chains, TRON and TON continued to operate, as did Octopools and its other components.

The team said it recovered about 15 BTC and moved the funds into a team-controlled multisignature wallet. It also offered the attacker a 20% white-hat bounty through September 13.

After that deadline, Symbiosis said the same percentage would be available to anyone who provided information that led to additional recoveries.

Symbiosis experienced a security incident. At approximately 04:28 UTC on Sep 11, 2026, attacker exploited a vulnerability in Bitcoin Bridge. BTC routes have been halted. Other routes remain operational and safe.

Where we stand:
• Only the Bitcoin Bridge was affected, and it is…

— Symbiosis (@symbiosis_fi) September 11, 2026

The unresolved issue is who absorbs the remaining loss

Symbiosis has restored Bitcoin swaps through partners Chainflip and THORChain, but that is different from reopening the project’s own bridge. The native route remains paused, and the team has not yet published its final loss figure.

The project also said it is contacting affected liquidity providers directly and building a compensation framework. That detail matters.

Recovering 15 BTC is meaningful, but it does not by itself establish whether every provider will be made whole, how claims will be calculated, or when funds will be available.

The bigger lesson is straightforward: a bridge can mint an absurd paper balance, but the real damage depends on the liquidity that can be reached before the system is stopped. Here, liquidity limited the first extraction.

Now governance, recovery work and a transparent compensation plan will determine how complete the containment really was.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.