Hackers Mint Trillions in Fake Bitcoin; 15 BTC Bridge Recovery Leaves Liquidity Providers Unpaid

Cross-chain protocol Symbiosis reported recovering roughly 15 BTC after an attacker exploited its native Bitcoin Bridge, yet the liquidity providers impacted have not yet received compensation as the September 13 bounty deadline approaches.

The breach occurred at approximately 04:28 UTC on September 11, according to Symbiosis’s incident statement. The exploit targeted only the Bitcoin Bridge; all other routes and components remained functional. The protocol highlighted that routes on EVM‑compatible chains, TRON, and TON were unaffected, and its relayer network continued to secure the system.

The 15 BTC figure represents the amount Symbiosis has recovered so far. Final accounting is still underway, and the protocol will release confirmed numbers in a subsequent update.

Security firm Blockaid reported that a transaction signed by Symbiosis’s BridgeV2 system minted roughly 2⁶² units of syBTC—a synthetic representation of Bitcoin—into a newly created wallet on the Binance Smart Chain.

Blockaid indicated that the beneficiary sold about 4.39 WBTC on Ethereum, netting approximately $336,000 in WBTC at the time of the alert. This amount reflects the value Blockaid observed the attacker convert, but it does not define Symbiosis’s ultimate loss or the total exposure for liquidity providers.

Symbiosis initially suspended Bitcoin‑related swaps while it implemented updates. A later operational update confirmed that Bitcoin swaps routed through partners Chainflip and THORChain have resumed, whereas the native Symbiosis Bitcoin Bridge remains paused.

Partner‑routed Bitcoin swaps are now accessible to users, keeping traffic off the paused native bridge while alternative pathways are utilized.

Symbiosis stated it is reaching out directly to each affected liquidity provider and developing a compensation framework, though the specific eligibility criteria, calculation method, and start date for payments have not been disclosed.

The protocol also extended a 20% white‑hat bounty to the attacker through September 13. After that period, the same bounty rate will apply to anyone supplying information leading to further recovery, though an exact cutoff time or timezone was not specified.

Affected liquidity providers await three key disclosures: definitive loss and exposure figures, compensation criteria, and any update on the native bridge’s status. Until Symbiosis releases this information, the recovered funds and Blockaid’s proceeds should not be considered a final loss assessment.

Source link