Symbiosis says it recovered 15 BTC after Bitcoin bridge exploit, offers attacker 20% bounty

Cross-chain liquidity protocol Symbiosis said it has recovered approximately 15 BTC after an exploit targeted its Bitcoin Bridge. The protocol is offering the attacker a 20% bounty for the return of funds.

On Sept. 11, an attacker exploited a vulnerability in the bridge, according to Symbiosis, which did not give further details on the nature of the hack. The project halted its native bitcoin routes and isolated the affected bridge from the rest of its infrastructure. Other routes across EVM networks, TRON and TON, as well as its Octopools product, remained operational, it said.

Symbiosis has since restored bitcoin swaps through third-party partners Chainflip and THORChain, though its own Bitcoin Bridge remains paused. The project's relayer network also continues to operate, according to Symbiosis.

"We are contacting every affected LP directly," Symbiosis wrote. "We are building a compensation framework and will publish the criteria shortly."

Symbiosis said the approximately 15 BTC it recovered is now being held in a team-controlled multisig wallet. The bitcoin is worth $1.15 million at current prices. 

Symbiosis has offered the attacker a white-hat bounty equal to 20% of the funds to claim through Sept. 13. After that window closes, the protocol said it would offer the same 20% reward to anyone providing information that leads to further recovery of the funds.

Symbiosis did not immediately respond to a request for comment from The Block. 

Billions of unbacked syBTC minted

Blockchain security firm Blockaid separately said it had detected an exploit on BNB Chain in which a call to Symbiosis's BridgeV2 contract minted roughly 46.1 billion syBTC, sending the tokens to a fresh address.

The quantity of unauthorized tokens is more than 2,000 times bitcoin's maximum 21 million coin supply, but Blockaid said the apparent attacker managed to sell only approximately 4.39 WBTC through Uniswap v4 on Ethereum, realizing around $336,000 in proceeds. DeFiLlama has similarly classified the incident as an "unbacked cross-chain mint" with a $336,000 loss.

The incident comes less than a week after an attacker exploited a separate bug affecting Blockstream's Liquid Network to create roughly 4,000 unbacked LBTC, redeeming them for bitcoin held by the network. The party responsible later returned approximately 3,400 BTC, though Blockstream has refused the attacker's demand for a bounty on the roughly 598.5 BTC still outstanding, The Block previously reported.

Other bridge exploits this year have likewise produced a large gap between the total unauthorized tokens issued and the actual practical amount of funds an attacker could extract from the targeted protocol. In April, an attacker exploited Polkadot-focused Hyperbridge to mint 1 billion bridged DOT but ultimately netted only about $237,000, a fraction of the theoretical value of the tokens. 

Symbiosis says it has facilitated more than $10 billion in transaction volume since launching about five years ago. The protocol currently has roughly $7 million in total value locked in the protocol, per DefiLlama data, and about $3.19 billion in bridge volume since its data series began.