Attack on native Bitcoin Bridge minted 2^62 syBTC units
Symbiosis, a cross-chain protocol, has recovered approximately 15 BTC following an exploit of its native Bitcoin Bridge on September 11, 2024. An attacker minted roughly 2^62 raw units of syBTC on BNB Chain and converted approximately 4.39 WBTC to fiat, realizing $336,000 in proceeds at the time of the security firm Blockaid’s alert.
The recovered bitcoin is now secured in a team-controlled multisig. Blockaid cautioned that the $336,000 figure covers only the value the attacker successfully converted and does not establish Symbiosis’s final loss or total liquidity provider exposure.
Other routes remain operational
Only the Bitcoin Bridge was affected by the exploit. Other cross-chain routes spanning EVM chains, TRON, and TON remained operational throughout the incident. Symbiosis’s relayer group continued operating to secure the network.
Bitcoin-related swaps have been rerouted through partner protocols Chainflip and THORChain and were restored online. The native Symbiosis Bitcoin Bridge itself remains paused pending resolution.
Compensation framework under construction
Symbiosis said it is contacting affected liquidity providers directly and building a compensation framework with criteria to follow. The company has not disclosed specific compensation terms, qualification criteria, or payment timelines.
A white-hat bounty offering 20% of recovered funds is available through September 13, 2024. After that date, Symbiosis said the same 20% bounty would be offered to anyone providing information leading to recovery of additional stolen funds.
The exact cutoff time and timezone for the September 13 bounty window have not been specified. Final accounting of the attack’s total impact remains in progress.
