Symbiosis Finance BridgeV2 syBTC Exploit (September 2026)
Last changed 2026-10-30 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 29 to 19. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2Gv4Hw…nPWaSummary
On September 11, 2026, an attacker exploited Symbiosis Finance's BridgeV2 contract to mint unbacked synthetic Bitcoin (syBTC), approximately 2^62 raw units or about 46.1 billion syBTC by the most cited count, more than 2,000 times Bitcoin's maximum supply; published accounts differ on whether the cause was two chained deposit-parsing and fee-arithmetic bugs or a failure to check relayer-signed messages against locked collateral. The attacker realised about $336,000 by selling roughly 4.39 WBTC on Uniswap V4, while KuCoin put the total protocol loss at 9.97 BTC (~$770,000). Symbiosis halted its native Bitcoin bridge, said it recovered about 15 BTC, offered a 20% bounty that expired unanswered, and announced a full rewrite and new audit before any relaunch; no post-mortem or verifying on-chain addresses had been published as of mid-September 2026.
Connected Entities
12 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- KuCoin→mentioned with→Uniswap(60%)
- KuCoin→mentioned with→Bitcoin(70%)
- KuCoin→mentioned with→Ethereum(60%)
- Binance→mentioned with→Ethereum(65%)
- Symbiosis Finance→mentioned with→KuCoin(75%)
- Symbiosis Finance→mentioned with→Bitcoin(80%)
- Symbiosis Finance→mentioned with→Ethereum(80%)
- Symbiosis Finance→mentioned with→Uniswap(65%)
- THORChain→mentioned with→Ethereum(70%)
- + 28 more
Community submissions
- https://www.coindesk.com/tech/2026/09/15/a-hacker-turned-25-cents-of-bitcoin-into-46-billion-fake-btc-tokens-on-a-defi-bridge(www.coindesk.com)
“Details the chained dual-bug root cause behind the syBTC over-mint, useful for assessing whether Symbiosis's patch fully addresses the underlying validation flaw.”
— avoid-scout(unverified)
5 submissions awaiting moderator review.
Timeline(14 events)
March 2022
Symbiosis Finance launched on mainnet; it went on to accumulate audit reports from Decurity, Zokyo, SlowMist and Omniscia across 11 protocol modules and reported no major security incidents before September 2026.
Symbiosis Security Audits Documentation2024
Decurity completed a security audit of the Symbiosis Relayers Network, the off-chain component responsible for MPC-signed message submission to BridgeV2.
Symbiosis Finance Audits Repository — GitHubOctober 2025
Decurity completed an audit of the Symbiosis Depository module, which relates to bridge and Bitcoin functionality. Whether the BridgeV2 code exploited in September 2026 fell within scope has not been confirmed.
Symbiosis recovers 15 BTC after Bitcoin Bridge exploit, offers attacker 20% bounty — Crypto BriefingSeptember 2026
On September 11 at approximately 04:28 UTC, an attacker submitted 330 satoshis (~$0.25) to the BridgeV2 contract and executed 12 irregular transactions across BNB Chain, Ethereum and Rootstock over roughly four minutes, minting approximately 46.1 billion unbacked syBTC to a freshly created EOA (KuCoin's account).
Symbiosis Hit by $770K Loss After Attacker Mints 46.1B syBTC — KuCoin NewsSeptember 2026
On September 11, per PANews, the attacker submitted forged BridgeV2 messages across eight transactions on BNB Chain, minting approximately 2^62 raw syBTC units (nominal face value ~$46.1 billion) to a newly created wallet without depositing real Bitcoin.
Cross-Chain Protocol Symbiosis on BSC Attacked, Attacker Cashed Out Approximately $336,000 — PANewsSeptember 2026
On September 11, Blockaid detected the anomalous on-chain activity in real time and publicly flagged the exploit on X (formerly Twitter).
Symbiosis Bitcoin Bridge Hacked: 46B Fake syBTC Minted in $336K Exploit — BlockonomiSeptember 2026
On September 11, the attacker bridged a portion of the minted syBTC to Ethereum and sold approximately 4.39 WBTC through Uniswap V4, realising approximately $336,000; the remaining tokens found no market demand.
Symbiosis Bitcoin Bridge Exploit Minted Billions in Fake syBTC, Hacker Walks Away with $336K — CoinCentralSeptember 2026
On September 11, Symbiosis suspended all native Bitcoin bridge routes upon confirming the exploit; EVM, TRON, TON and Octopool routes remained operational.
Symbiosis recovers 15 BTC after Bitcoin Bridge exploit, offers attacker 20% bounty — Crypto BriefingSeptember 2026
On September 11, Symbiosis stated that Bitcoin-related swap functions were unavailable while an update was being deployed.
Symbiosis: Bitcoin-related Swap Function Currently Unavailable, Team Deploying Update — PANewsSeptember 2026
Symbiosis announced it had recovered approximately 15 BTC (~$1.15 million) into a team-controlled multisig and offered the attacker a 20% white-hat bounty with a September 13 deadline; CoinPaprika dates the announcement to September 11.
A Hacker Minted 46 Billion Fake Bitcoin. Symbiosis Clawed Back 15 and Offered a 20% Bounty — CoinPaprikaSeptember 2026
On September 12, per PANews, Symbiosis confirmed the approximately 15 BTC recovery and the 20% bounty offer, said the final loss was still being calculated, and began contacting affected liquidity providers about compensation.
Symbiosis: Approximately 15 BTC Recovered, Final Loss Still Being Calculated, 20% White Hat Bounty Offered — PANewsSeptember 2026
On September 13 the white-hat bounty deadline expired without the attacker publicly responding or returning funds; Symbiosis redirected the 20% offer to anyone providing information leading to further recovery.
Symbiosis Recovers 15 BTC After Bridge Hack, Liquidity Providers Still Waiting on Compensation — The Currency AnalyticsSeptember 2026
On September 14, Symbiosis said final loss figures were still being calculated and that it was building a compensation framework with affected liquidity providers; a complete software rewrite and new external audit were announced as prerequisites for relaunching the bridge, with no timeline.
Symbiosis Recovers 15 BTC After Bridge Hack, Liquidity Providers Still Waiting on Compensation — The Currency AnalyticsSeptember 2026
By September 14, Bitcoin swaps had been restored through third-party partners Chainflip and THORChain while Symbiosis's own Bitcoin bridge remained suspended.
Symbiosis Bitcoin Bridge Hacked: 46B Fake syBTC Minted in $336K Exploit — BlockonomiDecision Log
- slot 463286053 · hash 6PaThyWeqHAddee2UNAkxNfEK8UJMt3Vd9nCFJ2zo5xw
- slot 463286048 · hash HcFgEvz8vdt6oAcgWuuqdZ5HvfXX8csr4YLrWABaXixP
- slot 457951324 · hash AdEHhaSmHbqKtjkyge1LD8PrUJsLCWz2H6WV2y9BczRJ
- slot 447847581 · hash GY97u8hV9gum1MAsTG9HFZSiFUXwuSiixBRCz9ipK6DG
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 26 of 26 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 9/17/2026, 5:04:18 PM
last updated: 10/30/2026, 12:31:24 PM
8 viewsavoid.net — verified advice for a post-truth world