Another Bitcoin Bridge Broke, and This Time Billions Were Minted

Bitcoin Bridge Exploit Mints Billions in Unbacked syBTC

This week, the onchain cybersecurity platform Blockaid discovered an issue with Symbiosis’s BTC Bridge. “Community alert,” Blockaid wrote on the social media platform X. “Signed BridgeV2 receive minted ~2^62 raw syBTC (8 decimals; face value ~46.1B) to a fresh EOA; same beneficiary dumped ~4.39 WBTC on Ethereum Uni V4. ~$336k realized WBTC proceeds so far.”

Put simply, the hacker tricked Symbiosis’s bitcoin bridge into creating a massive amount of unbacked synthetic BTC. However, the malicious entity only managed to sell a sliver of it for about $336,000 in real wrapped bitcoin (WBTC); the rest was a phony supply nobody would buy. Symbiosis also confirmed the attack on X.

Symbiosis Recovers 15 BTC and Offers Hacker a 20% Bounty

“Symbiosis experienced a security incident. At approximately 04:28 UTC on Sep 11, 2026, [an] attacker exploited a vulnerability in bitcoin bridge. BTC routes have been halted. Other routes remain operational and safe,” the team disclosed. The team has recovered approximately 15 BTC, now secured on a team-controlled multisig.”

Symbiosis added:

“We have contacted the attacker with a white-hat bounty offer of 20% of the funds, open until Sep 13, 2026. After that window, the same 20% will be offered to anyone providing information that leads to recovery.”

Liquid, Nomic, and Symbiosis Hit by the Same Basic Trick

What makes this incident worse is that this basic unbacking trick has happened three times over the last few weeks. While they are not exactly the same maneuvers, the Liquid Network was drained for nearly 4,000 BTC using unbacked assets, and similarly, Nomic had a hole that went unnoticed for months under similar circumstances.

All three incidents did the same basic trick. Essentially, they all convinced a bitcoin wrapper project to print extra coins that were supposed to stand for real tokens. As of Sunday morning, Sept. 13, Symbiosis still had no public technical post-mortem explaining exactly where BridgeV2 failed, no final dollar loss figure, and no public confirmation that the attacker accepted its 20% white-hat offer.