Symbiosis Bridge Vulnerability Leads to 46.1 Billion Unsecured syBTC Minted, Losses Estimated at $770,000

On September 15, it was reported that the cross-chain protocol Symbiosis revealed that two software vulnerabilities in its Bitcoin Bridge were exploited by attackers. The attackers deposited 330 satoshis of Bitcoin (approximately $0.25) and completed 12 fraudulent deposits in about 4 minutes through BNB Chain, Ethereum, and Rootstock, minting approximately 46.1 billion unsecured syBTC, which is over 2,000 times the Bitcoin supply cap of 21 million. Symbiosis stated that the bridge read incorrect fields in Bitcoin transactions when identifying the payer, allowing the attackers to be recognized as authorized depositors and bridge administrators. The attackers set the minimum fee to a negative number, which led to another vulnerability where the deposit amount increased instead of decreasing when the negative fee was deducted. Before the attack, the supply of syBTC was only 13.91, with 11.26 in liquidity pools paired with WBTC, cbBTC, BTCB, and RBTC. The project team initially estimated that liquidity providers and affected users lost 9.97 BTC, approximately $770,000, and plans to use part of the Bitcoin transferred during the attack protection and other compensation arrangements to cover the losses. Currently, the native Bitcoin Bridge remains disabled, and the related software is being rewritten and undergoing independent audits.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.