Audit log

Every state-changing event for Symbiosis Protocol — syBTC Bridge Inflation Exploit: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-16 23:09:53Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 457,815,452

   sig

   41zZRYm32Eno…usZaDtBecopyexplorer ↗

   hash

   8sUxLrwQDYye…4UBWrXBScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18486 B) ▸

   {"actor":"system:backfill","investigation_id":"128ab95f-73f9-4805-9517-c2483806f806","kind":"publish","page_slug":"symbiosis-protocol-sybtc-bridge-inflation-exploit","published_at":"2026-10-16T23:09:52.954Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Symbiosis Protocol — syBTC Bridge Inflation Exploit","sections":[{"content":"At approximately 04:28 UTC on September 11, 2026, blockchain security firm Blockaid detected an anomalous call to the Symbiosis Finance BridgeV2 contract on BNB Chain. The call resulted in the minting of approximately 46.1 billion syBTC — a synthetic Bitcoin token intended to represent bridged Bitcoin at a 1:1 ratio — to a newly created externally owned account. The minted quantity exceeded Bitcoin's hard-capped 21 million coin maximum supply by more than 2,000 times. Symbiosis Finance is a cross-chain decentralized exchange (DEX) that had processed over $10 billion in cumulative transaction volume since its mainnet launch circa 2022. The protocol operates across EVM chains, BNB Chain, TRON, and TON, and introduced a native Bitcoin Bridge as part of its BridgeV2 infrastructure. Only the Bitcoin Bridge was affected; all other cross-chain routes remained operational throughout the incident.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Symbiosis Bitcoin Bridge Exploit Minted Billions in Fake syBTC — CoinCentral","type":"news_article","url":"https://coincentral.com/symbiosis-bitcoin-bridge-exploit-minted-billions-in-fake-sybtc-hacker-walks-away-with-336k"},{"credibility":2,"name":"A Hacker Minted 46 Billion Fake Bitcoin — Coinpaprika","type":"news_article","url":"https://coinpaprika.com/news/hacker-minted-46-billion-fake-bitcoin/"},{"credibility":2,"name":"Symbiosis Bridge Exploit: Hacker Mints 368.9 Billion Synthetic Bitcoin — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/11/symbiosis-bridge-exploit-hacker-mints-368-9-billion-synthetic-bitcoin/"}]},{"content":"The flaw resided in the BridgeV2 contract's message authentication and fee-handling logic. According to reporting by Blockaid and subsequent analyses, two related weaknesses enabled the exploit. First, the contract examined the wrong portion of an incoming Bitcoin transaction when verifying the sender's identity, allowing the attacker to appear simultaneously as an approved depositor and a bridge administrator. Second, the contract treated a negative fee calculation as an addition rather than a deduction, removing any effective cap on token issuance. Combined, these flaws allowed the attacker to submit a crafted signed message — reportedly initiated with a deposit of as little as 330 satoshis (approximately $0.25) — that caused the contract to generate approximately 2^62 raw units of syBTC on both BNB Chain and Ethereum without any corresponding Bitcoin collateral. The vulnerability is described across reporting as an unbounded minting flaw: under different liquidity conditions, the entire notional mint of $46.1 billion in synthetic tokens could theoretically have been realized. Symbiosis had prior security audits from Decurity, Zokyo, SlowMist, and Omniscia, though the BridgeV2 Bitcoin-specific contract path was not prevented from containing this flaw.","heading":"Technical Vulnerability","severity":"critical","sources":[{"credibility":2,"name":"Symbiosis Bitcoin Hack Exposes Massive Token Minting Flaw — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/14/symbiosis-bitcoin-hack/"},{"credibility":2,"name":"Symbiosis Bridge Bug Let A Hacker Mint More Bitcoin Than Will Ever Exist — Startup Fortune","type":"news_article","url":"https://startupfortune.com/symbiosis-bridge-bug-let-a-hacker-mint-more-bitcoin-than-will-ever-exist/"},{"credibility":2,"name":"Symbiosis Recovers 15 Bitcoin After BridgeV2 Flaw — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/bitcoin/symbiosis-recovers-15-bitcoin-after-bridgev2-flaw-lets-attacker-mint-46-billion-unbacked-tokens-293376"},{"credibility":3,"name":"Hacker Turns 25 Cents of Bitcoin Into 46 Billion Fake Tokens — Archyde","type":"news_article","url":"https://www.archyde.com/hacker-turns-25-cents-of-bitcoin-into-46-billion-fake-tokens-on-symbiosis-bridge/"}]},{"content":"Despite the notional scale of 46.1 billion unbacked tokens, actual realized losses were constrained by available on-chain liquidity. The attacker converted approximately 4.39 WBTC through Uniswap v4 on Ethereum, netting approximately $336,000. An estimated 184.5 billion syBTC reportedly remained on BNB Chain unconverted. Separately, Symbiosis recovered approximately 15 BTC — valued at roughly $1.15 million at the time of recovery — and secured these funds in a team-controlled multisig wallet. The gap between the $336,000 in confirmed attacker proceeds and the 15 BTC recovered reflects uncertainty in the final accounting: as of the reporting date, Symbiosis had not published final loss figures or disclosed how much, if any, of the recovered BTC came from the attacker's remaining holdings versus other sources. Affected liquidity providers were being contacted individually, and a compensation framework was described as under preparation but had not been released.","heading":"Financial Impact and Realized Losses","severity":"high","sources":[{"credibility":2,"name":"Hackers Mint Trillions in Fake Bitcoin, Liquidity Providers Still Waiting — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/hackers-mint-trillions-in-fake-bitcoin-but-15-btc-bridge-recovery-leaves-liquidity-providers-unpaid/"},{"credibility":2,"name":"Symbiosis Recovers 15 BTC After Bridge Hack, LPs Still Waiting — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/bitcoin/symbiosis-recovers-15-btc-after-bridge-hack-liquidity-providers-still-waiting-on-compensation-293312"},{"credibility":2,"name":"Symbiosis recovers 15 BTC after attacker mints billions of syBTC — Crypto.news","type":"news_article","url":"https://crypto.news/symbiosis-recovers-15-btc-after-attacker-mints-billions-of-sybtc/"}]},{"content":"Symbiosis halted its native Bitcoin routing within the same timeframe as the breach and confirmed the isolation of the affected bridge from network operations. The team stated publicly that non-BTC routes remained unaffected and that funds in ETH and stablecoin pools were safe. Bitcoin swaps were later made available through third-party integrations with Chainflip and THORChain, providing an alternative route for users while the native bridge remained offline. Symbiosis offered the attacker a 20% white-hat bounty on any returned funds, with a deadline of September 13, 2026. After that deadline passed, the same 20% reward was extended to any third party providing information leading to further fund recovery. The team stated it was engaging with security research teams and intended to publish a compensation framework for affected liquidity providers, though no finalized criteria had been released as of the dates covered in available reporting. The recovered 15 BTC was placed in a multisig wallet to prevent unilateral movement during any ongoing negotiations.","heading":"Protocol Response and Bounty Offer","severity":"medium","sources":[{"credibility":2,"name":"Symbiosis recovers 15 BTC after Bitcoin Bridge exploit — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/symbiosis-bitcoin-bridge-exploit-bounty-recovery/"},{"credibility":2,"name":"Symbiosis Recovers 15 BTC, Bitcoin Bridge Remains Paused — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/09/symbiosis-recovers-15-btc-bitcoin-bridge-exploit"},{"credibility":2,"name":"Symbiosis halts BTC bridge after exploit, spotlighting cross-chain risk — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/symbiosis-halts-btc-bridge-after-exploit-spotlighting-cross-chain-risk/"}]},{"content":"Symbiosis Finance is a cross-chain DEX founded circa 2021 and launched on mainnet around early 2022. The team is led by Will Kamalov (CEO), Nick Avramov (CBDO), and Alexey Lushnikov (CTO). The protocol uses an on-chain liquidity pool system and an off-chain relayer network secured by Multi-Party Computation (MPC) threshold signatures to enable asset exchange across chains. Prior to this incident, Symbiosis had accumulated security audits from at least four firms — Decurity (2023), Zokyo, SlowMist, and Omniscia — and had operated without a reported major security incident for several years. The breach has been cited in industry reporting as the third major Bitcoin bridge incident within a short period in 2026, following a $320 million breach to the Liquid Network. Total historical bridge losses across the industry have been estimated by DeFiLlama at approximately $3.68 billion.","heading":"Protocol Background and Audit History","severity":"medium","sources":[{"credibility":2,"name":"Symbiosis Finance — LI.FI Deep Dive","type":"research","url":"https://li.fi/knowledge-hub/symbiosis-a-deep-dive"},{"credibility":2,"name":"Symbiosis halts BTC bridge after exploit — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/symbiosis-halts-btc-bridge-after-exploit-spotlighting-cross-chain-risk/"},{"credibility":1,"name":"Security Audit Report Symbiosis Finance — Decurity 2023","type":"other","url":"https://resources.cryptocompare.com/asset-management/1878/1701171168435.pdf"}]},{"content":"The Symbiosis incident illustrates a systemic risk category in cross-chain bridge design: insufficient message authentication in contracts that mint synthetic representations of external assets. Industry researchers have noted that the ceiling on actual financial damage in such exploits is set by available liquidity rather than by any constraint in the contract itself. The Symbiosis attacker was limited to approximately $336,000 because on-chain liquidity was shallow; a deeper liquidity environment could have enabled losses orders of magnitude larger from the same flaw. A 2026 cross-chain bridge security study referenced in reporting identified 830 distinct flaws across bridge implementations, with lack of strong message authentication cited as a primary risk factor. The Symbiosis BTC bridge remains halted as of available reporting with no disclosed timeline for resumption of the native bridge.","heading":"Cross-Chain Bridge Risk Context","severity":"high","sources":[{"credibility":2,"name":"Cross-Chain Bridge Security: 830 Flaws Found — Shattered.io","type":"research","url":"https://shattered.io/cross-chain-bridge-security-830-flaws-2026/"},{"credibility":2,"name":"Symbiosis Bridge Hack: $46B Bug Mints, $336K Stolen — Shattered.io","type":"news_article","url":"https://shattered.io/symbiosis-bridge-exploit-46-billion-sybtc-2026/"},{"credibility":2,"name":"Symbiosis Bitcoin Bridge Hack — Parameter.io","type":"news_article","url":"https://parameter.io/symbiosis-bitcoin-bridge-hack-46-billion-fake-sybtc-tokens-created-attacker-takes-336k/"}]}],"sources_used":[{"credibility":2,"name":"A Hacker Minted 46 Billion Fake Bitcoin — Coinpaprika","type":"news_article","url":"https://coinpaprika.com/news/hacker-minted-46-billion-fake-bitcoin/"},{"credibility":2,"name":"Symbiosis Bridge Exploit: Hacker Mints 368.9 Billion Synthetic Bitcoin — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/11/symbiosis-bridge-exploit-hacker-mints-368-9-billion-synthetic-bitcoin/"},{"credibility":2,"name":"Symbiosis halts BTC bridge after exploit, spotlighting cross-chain risk — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/symbiosis-halts-btc-bridge-after-exploit-spotlighting-cross-chain-risk/"},{"credibility":2,"name":"Symbiosis recovers 15 BTC after Bitcoin Bridge exploit, offers attacker 20% bounty — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/symbiosis-bitcoin-bridge-exploit-bounty-recovery/"},{"credibility":2,"name":"Hackers Mint Trillions in Fake Bitcoin, Liquidity Providers Unpaid — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/hackers-mint-trillions-in-fake-bitcoin-but-15-btc-bridge-recovery-leaves-liquidity-providers-unpaid/"},{"credibility":2,"name":"Symbiosis Recovers 15 Bitcoin After BridgeV2 Flaw — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/bitcoin/symbiosis-recovers-15-bitcoin-after-bridgev2-flaw-lets-attacker-mint-46-billion-unbacked-tokens-293376"},{"credibility":2,"name":"Symbiosis Recovers 15 BTC After Bridge Hack, LPs Waiting — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/bitcoin/symbiosis-recovers-15-btc-after-bridge-hack-liquidity-providers-still-waiting-on-compensation-293312"},{"credibility":2,"name":"Symbiosis recovers 15 BTC after attacker mints billions of syBTC — Crypto.news","type":"news_article","url":"https://crypto.news/symbiosis-recovers-15-btc-after-attacker-mints-billions-of-sybtc/"},{"credibility":2,"name":"Symbiosis Bitcoin Hack Exposes Massive Token Minting Flaw — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/14/symbiosis-bitcoin-hack/"},{"credibility":2,"name":"Symbiosis Bitcoin Bridge Exploit Minted Billions in Fake syBTC — CoinCentral","type":"news_article","url":"https://coincentral.com/symbiosis-bitcoin-bridge-exploit-minted-billions-in-fake-sybtc-hacker-walks-away-with-336k"},{"credibility":2,"name":"Symbiosis Bridge Bug Let A Hacker Mint More Bitcoin Than Will Ever Exist — Startup Fortune","type":"news_article","url":"https://startupfortune.com/symbiosis-bridge-bug-let-a-hacker-mint-more-bitcoin-than-will-ever-exist/"},{"credibility":2,"name":"Symbiosis Recovers 15 BTC, Bitcoin Bridge Remains Paused — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/09/symbiosis-recovers-15-btc-bitcoin-bridge-exploit"},{"credibility":2,"name":"Cross-Chain Bridge Security: 830 Flaws Found — Shattered.io","type":"research","url":"https://shattered.io/cross-chain-bridge-security-830-flaws-2026/"},{"credibility":2,"name":"Symbiosis Bridge Hack: $46B Bug Mints, $336K Stolen — Shattered.io","type":"news_article","url":"https://shattered.io/symbiosis-bridge-exploit-46-billion-sybtc-2026/"},{"credibility":2,"name":"Symbiosis Bitcoin Bridge Hack — Parameter.io","type":"news_article","url":"https://parameter.io/symbiosis-bitcoin-bridge-hack-46-billion-fake-sybtc-tokens-created-attacker-takes-336k/"},{"credibility":3,"name":"Hacker Turns 25 Cents of Bitcoin Into 46 Billion Fake Tokens — Archyde","type":"news_article","url":"https://www.archyde.com/hacker-turns-25-cents-of-bitcoin-into-46-billion-fake-tokens-on-symbiosis-bridge/"},{"credibility":1,"name":"Security Audit Report Symbiosis Finance — Decurity 2023","type":"other","url":"https://resources.cryptocompare.com/asset-management/1878/1701171168435.pdf"},{"credibility":2,"name":"Symbiosis Finance — LI.FI Deep Dive","type":"research","url":"https://li.fi/knowledge-hub/symbiosis-a-deep-dive"}],"summary":"On September 11, 2026, an attacker exploited a vulnerability in the Symbiosis Finance BridgeV2 smart contract on BNB Chain to mint approximately 46.1 billion unbacked syBTC tokens — more than 2,000 times Bitcoin's total supply cap of 21 million coins. Realized losses were limited to approximately $336,000 due to liquidity constraints, but the underlying vulnerability demonstrated an unbounded minting flaw with potential for catastrophic losses under deeper liquidity conditions. Symbiosis halted its native Bitcoin Bridge, recovered roughly 15 BTC into a team-controlled multisig, and offered the attacker a 20% white-hat bounty; as of the reporting date the bridge remains paused and a compensation framework for affected liquidity providers had not been finalized.","timeline":[{"date":"2022-01-01","event":"Symbiosis Finance launches on mainnet as a cross-chain DEX. Approximate date; exact launch date not confirmed in available reporting.","source":"LI.FI Deep Dive on Symbiosis","source_url":"https://li.fi/knowledge-hub/symbiosis-a-deep-dive"},{"date":"2023-11-28","event":"Decurity publishes a security audit report for Symbiosis Finance smart contracts.","source":"Decurity Audit Report via CryptoCompare","source_url":"https://resources.cryptocompare.com/asset-management/1878/1701171168435.pdf"},{"date":"2026-09-11","event":"At approximately 04:28 UTC, Blockaid detects an anomalous call to the Symbiosis BridgeV2 contract on BNB Chain. Attacker mints approximately 46.1 billion unbacked syBTC tokens to a newly created wallet address using a crafted signed message exploiting a flaw in fee logic and sender verification. Symbiosis halts native Bitcoin routing. Attacker converts approximately 4.39 WBTC for roughly $336,000 via Uniswap v4 on Ethereum.","source":"Multiple: Coinpaprika, CryptoTimes, Cryptopolitan","source_url":"https://coinpaprika.com/news/hacker-minted-46-billion-fake-bitcoin/"},{"date":"2026-09-11","event":"Symbiosis confirms only its Bitcoin Bridge is affected. Non-BTC routes including EVM chains, TRON, and TON remain operational. Team states it is working with security research teams.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/11/symbiosis-bridge-exploit-hacker-mints-368-9-billion-synthetic-bitcoin/"},{"date":"2026-09-13","event":"Symbiosis publishes a status update. The protocol announces it has recovered approximately 15 BTC (secured in a team-controlled multisig wallet) and offered the attacker a 20% white-hat bounty for return of remaining funds. Deadline for the bounty offer passes. The same 20% reward is subsequently extended to anyone providing information leading to further recovery.","source":"Crypto Briefing, CryptoDaily","source_url":"https://cryptobriefing.com/symbiosis-bitcoin-bridge-exploit-bounty-recovery/"},{"date":"2026-09-14","event":"Additional reporting confirms Bitcoin swaps have been re-enabled through third-party integrations with Chainflip and THORChain. Symbiosis states it is contacting affected liquidity providers individually and preparing a compensation framework. No finalized criteria or payment timeline is disclosed. Native BTC bridge remains paused.","source":"CryptoSlate, The Currency Analytics","source_url":"https://cryptoslate.com/hackers-mint-trillions-in-fake-bitcoin-but-15-btc-bridge-recovery-leaves-liquidity-providers-unpaid/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4563ca9c-1118-4084-b95d-b436f369dac2copy