Symbiosis Recovers 15 BTC Post-Bridge Exploit | MoneyAllotment

Cross-chain liquidity protocol Symbiosis has recovered approximately 15 BTC following an exploit of its Bitcoin Bridge, and is offering the attacker a bounty worth a fifth of the funds in exchange for returning the rest.

Symbiosis said the vulnerability was exploited at roughly 04:28 UTC on September 11, 2026, though it has not disclosed the technical root cause of the breach. The protocol immediately halted native bitcoin routing and isolated the affected bridge from the rest of its infrastructure. Routes on EVM networks, TRON and TON, along with its Octopools liquidity product, continued operating, according to the company. Bitcoin swaps have since been restored through third-party partners Chainflip and THORChain, though Symbiosis's own Bitcoin Bridge remains paused, and its relayer network continues to run.

The recovered 15 BTC is now held in a multisig wallet controlled by the Symbiosis team — an arrangement that requires multiple keyholders to sign off on any transaction, preventing a single party from moving the funds unilaterally. At bitcoin's price near USD 77,300 at the time the recovery was disclosed, that amount was worth roughly USD 1.15 million.

How the exploit worked

Blockchain security firm Blockaid said it detected the incident on BNB Chain, where a transaction accepted as signed by Symbiosis's BridgeV2 system minted approximately 46.1 billion units of syBTC — a synthetic representation of bitcoin used on the protocol — to a newly created wallet. That figure is more than 2,000 times bitcoin's fixed 21 million coin supply cap, underscoring that the tokens minted had no real backing.

Despite the scale of the unbacked mint, Blockaid said the attacker only managed to convert a small fraction of it into real value: about 4.39 WBTC sold through Uniswap v4 on Ethereum, netting roughly USD 336,000. DeFiLlama has classified the incident on its hack tracker as an "unbacked cross-chain mint" with a USD 336,000 loss, a figure that reflects what Blockaid observed the attacker extract rather than Symbiosis's full exposure or the ultimate cost to its liquidity providers.

Symbiosis said in a statement that it is contacting affected liquidity providers directly and is building a compensation framework, which it plans to publish separately. As of this writing, the company had not disclosed confirmed final loss figures, and it did not immediately respond to a request for comment from The Block.

A bounty deadline and a pattern of bridge failures

Symbiosis's offer gives the attacker until September 13, 2026, to accept a white-hat bounty worth 20% of the recovered or returned funds. After that window closes, the company said it would extend the same 20% reward to anyone who provides information that leads to further recovery.

The exploit is the latest in a string of incidents this year involving bitcoin-backed or bitcoin-bridged tokens. Less than a week earlier, an attacker exploited a separate bug in Blockstream's Liquid Network, minting roughly 4,000 unbacked L-BTC and redeeming a portion for real bitcoin. That attacker later returned approximately 3,400 BTC, but Blockstream refused a ransom demand tied to the roughly 598.5 BTC still outstanding. In April, an attacker exploited Polkadot-focused bridge Hyperbridge to mint 1 billion bridged DOT, ultimately extracting only about USD 237,000 — a similarly small fraction of the tokens' face value.

Symbiosis says it has facilitated more than USD 10 billion in cumulative transaction volume since launching roughly five years ago, with about USD 3.19 billion of that in bridge volume specifically. The protocol currently holds roughly USD 7 million in total value locked, according to DeFiLlama data.

Disclaimer: This article is for informational and educational purposes only and is not personalized financial, investment, or legal advice. Consult a licensed professional for advice specific to your situation.