Symbiosis Protocol — syBTC Bridge Inflation Exploit
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·41zZRY…DtBeSummary
On September 11, 2026, an attacker exploited a vulnerability in the Symbiosis Finance BridgeV2 smart contract on BNB Chain to mint approximately 46.1 billion unbacked syBTC tokens — more than 2,000 times Bitcoin's total supply cap of 21 million coins. Realized losses were limited to approximately $336,000 due to liquidity constraints, but the underlying vulnerability demonstrated an unbounded minting flaw with potential for catastrophic losses under deeper liquidity conditions. Symbiosis halted its native Bitcoin Bridge, recovered roughly 15 BTC into a team-controlled multisig, and offered the attacker a 20% white-hat bounty; as of the reporting date the bridge remains paused and a compensation framework for affected liquidity providers had not been finalized.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(6 events)
1 January 2022
Symbiosis Finance launches on mainnet as a cross-chain DEX. Approximate date; exact launch date not confirmed in available reporting.
LI.FI Deep Dive on Symbiosis28 November 2023
Decurity publishes a security audit report for Symbiosis Finance smart contracts.
Decurity Audit Report via CryptoCompare11 September 2026
At approximately 04:28 UTC, Blockaid detects an anomalous call to the Symbiosis BridgeV2 contract on BNB Chain. Attacker mints approximately 46.1 billion unbacked syBTC tokens to a newly created wallet address using a crafted signed message exploiting a flaw in fee logic and sender verification. Symbiosis halts native Bitcoin routing. Attacker converts approximately 4.39 WBTC for roughly $336,000 via Uniswap v4 on Ethereum.
Multiple: Coinpaprika, CryptoTimes, Cryptopolitan11 September 2026
Symbiosis confirms only its Bitcoin Bridge is affected. Non-BTC routes including EVM chains, TRON, and TON remain operational. Team states it is working with security research teams.
CryptoTimes13 September 2026
Symbiosis publishes a status update. The protocol announces it has recovered approximately 15 BTC (secured in a team-controlled multisig wallet) and offered the attacker a 20% white-hat bounty for return of remaining funds. Deadline for the bounty offer passes. The same 20% reward is subsequently extended to anyone providing information leading to further recovery.
Crypto Briefing, CryptoDaily14 September 2026
Additional reporting confirms Bitcoin swaps have been re-enabled through third-party integrations with Chainflip and THORChain. Symbiosis states it is contacting affected liquidity providers individually and preparing a compensation framework. No finalized criteria or payment timeline is disclosed. Native BTC bridge remains paused.
CryptoSlate, The Currency AnalyticsDecision Log
- slot 457815452 · hash 8sUxLrwQDYyef3p9jwXVJRYwEXV8WPGeoNpU4UBWrXBS
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 10 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/16/2026, 11:09:44 PM
last updated: 10/16/2026, 11:09:44 PM
avoid.net — verified advice for a post-truth world