Skip to main content
AVOID.NET

Symbiosis Finance (BTC Bridge Exploit)

avoid.net/symbiosis-finance-btc-bridge-exploit32/100·72% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3ADqAF…tuNk

Summary

On September 11, 2026, an attacker exploited a message-authentication flaw in Symbiosis Finance's BridgeV2 contract on BNB Chain, minting approximately 2^62 raw units of unbacked synthetic Bitcoin (syBTC) with a nominal face value of roughly $46.1 billion. The attacker extracted approximately $336,000 in real value by selling 4.39 WBTC through Uniswap V4 on Ethereum before the protocol detected the breach and halted BTC routing. As of September 13, 2026, a post-mortem and patch had not been publicly confirmed, and the final loss calculation remained open while Symbiosis offered the attacker a 20% white-hat bounty with a September 13 deadline.

Connected Entities

1 entities
Protocols
Symbiosis Finance (BTC Bridge Exploit)
Relationships
    Have evidence about Symbiosis Finance (BTC Bridge Exploit)?

    Timeline(7 events)

    1 March 2022

    Symbiosis Finance launched on mainnet. Protocol had been live with zero major security incidents prior to September 2026 according to reporting.

    Symbiosis Finance documentation / reporting

    1 January 2024

    Decurity completed a security audit of the Symbiosis Relayers Network, the off-chain component responsible for MPC-signed message submission to BridgeV2.

    Symbiosis Finance Audits Repository — GitHub

    11 September 2026

    At approximately 04:28 UTC, an attacker submitted forged BridgeV2 messages across eight transactions on BNB Chain, minting approximately 2^62 raw syBTC units (nominal face value ~$46.1 billion) to a newly created wallet without depositing any real Bitcoin.

    PANews / Blockaid / Cryptopolitan

    11 September 2026

    Attacker bridged a portion of the minted syBTC to Ethereum and sold approximately 4.39 WBTC through Uniswap V4, realizing approximately $336,000 in actual proceeds.

    Crypto Times / Shattered.io

    11 September 2026

    Symbiosis Finance detected the attack via Blockaid monitoring and immediately halted all BTC bridge routing. Non-BTC routes remained operational. Team issued public statement that Bitcoin-related swap functions were unavailable while an update was being deployed.

    PANews / Coin-Turk

    12 September 2026

    Symbiosis confirmed recovery of approximately 15 BTC into a team-controlled multi-signature wallet. Team offered the attacker a 20% white-hat bounty with a deadline of September 13, 2026, to return remaining funds. Team began contacting affected liquidity providers regarding compensation.

    PANews

    13 September 2026

    White-hat bounty deadline passed. Outcome of negotiation, final loss total, patch status, and post-mortem publication had not been publicly confirmed as of this investigation date.

    AVOID.NET investigation (unresolved as of 2026-09-13)
    Provenance & Audit Trail

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 14 of 14 cited source URLs have an Internet Archive snapshot.

    model: claude-sonnet-4-6

    generated: 9/13/2026, 12:04:39 PM

    last updated: 9/14/2026, 1:17:47 AM

    3 views

    avoid.net — verified advice for a post-truth world