Symbiosis's bitcoin bridge just handed some guy billions in unbacked syBTC, and he strolled off with $336,000 in real WBTC. Billions in fake, $336k in actual money. Blockaid caught the mint onchain at 04:28 UTC on Sep 11, 2026; Symbiosis froze BTC routes and dangled a 20% white-hat bounty until Sep 13.
▪️ How it went down: one signed BridgeV2 receive call minted ~2^62 raw syBTC (8 decimals) to a fresh EOA — no collateral, no nothing, the bridge just trusted the signature.
▪️ The exit was pure comedy: same wallet dumped ~4.39 WBTC on Ethereum's Uniswap V4. The rest of that fake supply? Nobody would touch it at any price.
▪️ Symbiosis confirmed it: BTC routes halted, other routes still live, funds clawed back into a team-controlled multisig.
▪️ White-hat offer: 20% of the funds to the attacker, open until Sep 13, 2026. After that, the same 20% goes to whoever doxes him.
▪️ Third time in weeks: Blockstream's Liquid Network lost nearly 4,000 BTC to unbacked assets — crew returned 3,400, kept ~598.5. Nomic's nBTC hole sat for months. Same movie, different poster.
▪️ As of Sunday morning, Sep 13: no post-mortem on where BridgeV2 failed, no final loss figure, no word on whether the attacker took the deal. Silence is a strategy, apparently.
📊 Fake syBTC minted:
~46.1B face value📊 Real WBTC cashed out:
~$336,000📊 Recovered to team multisig:
~15 BTC📊 White-hat bounty:
20%Three bitcoin wrappers in a matter of weeks, all of them printing coins that don't exist, and it's the exact same playbook every time: the bridge trusts a signature, the attacker mints, and whoever's left holding the wrapped token eats the risk. Symbiosis still hasn't said where BridgeV2 failed, still hasn't published a final loss figure, and BTC routes are halted — so if you're parked in syBTC or anything that routes through that bridge, you're not holding a bitcoin, you're holding a question mark. Now look at the going rate for a bridge bug: Liquid's crew returned 3,400 BTC and kept ~598.5, and Symbiosis is offering 20% to the same flavor of guy. Cheaper to pay the thief than to fix the code, apparently.
💬 «Community alert. Signed BridgeV2 receive minted ~2^62 raw syBTC (8 decimals; face value ~46.1B) to a fresh EOA; same beneficiary dumped ~4.39 WBTC on Ethereum Uni V4. ~$336k realized WBTC proceeds so far.» — Blockaid
🔮 Mint 46 billion, cash out $336k. The bridge never checked the coins existed — and neither did anyone else.
@exverse_chat
