A Symbiosis bridge attacker created about 46.1 billion synthetic bitcoin tokens from a deposit worth just 25 cents. The September 11 exploit exposed two coding flaws that allowed the attacker to bypass normal minting controls.
Consequently, the attacker produced syBTC without depositing enough real bitcoin to support the tokens. The incident highlights how a small software error can create enormous risks across cross-chain systems.
Two Flaws Enabled Massive Minting
The attacker deposited only 330 satoshis before sending 12 fraudulent transactions across three networks. Those transactions involved BNB Chain, Ethereum, and Rootstock within roughly four minutes.
Symbiosis identified two separate bugs behind the incident. One flaw caused the bridge to check the wrong transaction data when verifying the sender. The second flaw incorrectly handled negative fees as additions.
Together, those errors allowed the attacker to generate syBTC without meaningful limits. Significantly, the minted amount exceeded Bitcoin’s 21 million coin supply by more than 2,000 times.
Losses Remain Limited
However, the attacker converted only a small portion of the fabricated tokens into actual value. The attacker sold 4.39 wrapped bitcoin through Uniswap V4 and reportedly gained about $336,000.
Symbiosis initially estimated losses at 9.97 BTC. Additionally, the team recovered roughly 15 BTC by September 12. Hence, the protocol plans to rewrite its bridge code and commission an independent security audit before reopening.
Related: Robinhood Engineers Charged Over Alleged Crypto Listing Trading Scheme
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
