Symbiosis Bridge Exploit Let Hacker Mint 46 Billion Fake Bitcoin Tokens From 25 Cents

An attacker exploited two software flaws in Symbiosis’ Bitcoin Bridge to turn a deposit worth just 25 cents into roughly 46.1 billion unbacked syBTC tokens, more than 2,000 times bitcoin’s entire 21 million coin supply cap.

How The Exploit Worked

According to a post-mortem published by Symbiosis, the attacker made 12 fraudulent deposits across BNB Chain, Ethereum and Rootstock within about four minutes, starting with a deposit of just 330 satoshi. The bridge incorrectly identified who sent a bitcoin transaction, allowing the attacker to appear as both an approved depositor and the bridge’s administrator. That access let the attacker push the bridge’s minimum fee below zero, and a second bug caused that negative fee to be added to the deposit rather than subtracted, letting the attacker inflate the deposit’s recorded value arbitrarily.

Actual Losses Far Smaller Than Tokens Created

Before the attack, total syBTC supply stood at just under 14 tokens, with roughly 11 tokens sitting in liquidity pools tied to other wrapped bitcoin assets. Because minting fake bridge tokens doesn’t create real backing assets, Symbiosis estimates actual losses at about 9.97 BTC, or roughly $770,000, since the attacker could only extract real value from existing liquidity pools. The protocol currently holds about $8 million in total value locked despite processing $146 million in bridge volume over the past month.

Symbiosis says it plans to cover losses using recovered funds and separate compensation for affected liquidity providers, while its Bitcoin Bridge remains offline pending a rewrite and independent audit of the affected code.