Symbiosis Finance (BTC Bridge Exploit)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3ADqAF…tuNkSummary
On September 11, 2026, an attacker exploited a message-authentication flaw in Symbiosis Finance's BridgeV2 contract on BNB Chain, minting approximately 2^62 raw units of unbacked synthetic Bitcoin (syBTC) with a nominal face value of roughly $46.1 billion. The attacker extracted approximately $336,000 in real value by selling 4.39 WBTC through Uniswap V4 on Ethereum before the protocol detected the breach and halted BTC routing. As of September 13, 2026, a post-mortem and patch had not been publicly confirmed, and the final loss calculation remained open while Symbiosis offered the attacker a 20% white-hat bounty with a September 13 deadline.
Connected Entities
1 entitiesTimeline(7 events)
1 March 2022
Symbiosis Finance launched on mainnet. Protocol had been live with zero major security incidents prior to September 2026 according to reporting.
Symbiosis Finance documentation / reporting1 January 2024
Decurity completed a security audit of the Symbiosis Relayers Network, the off-chain component responsible for MPC-signed message submission to BridgeV2.
Symbiosis Finance Audits Repository — GitHub11 September 2026
At approximately 04:28 UTC, an attacker submitted forged BridgeV2 messages across eight transactions on BNB Chain, minting approximately 2^62 raw syBTC units (nominal face value ~$46.1 billion) to a newly created wallet without depositing any real Bitcoin.
PANews / Blockaid / Cryptopolitan11 September 2026
Attacker bridged a portion of the minted syBTC to Ethereum and sold approximately 4.39 WBTC through Uniswap V4, realizing approximately $336,000 in actual proceeds.
Crypto Times / Shattered.io11 September 2026
Symbiosis Finance detected the attack via Blockaid monitoring and immediately halted all BTC bridge routing. Non-BTC routes remained operational. Team issued public statement that Bitcoin-related swap functions were unavailable while an update was being deployed.
PANews / Coin-Turk12 September 2026
Symbiosis confirmed recovery of approximately 15 BTC into a team-controlled multi-signature wallet. Team offered the attacker a 20% white-hat bounty with a deadline of September 13, 2026, to return remaining funds. Team began contacting affected liquidity providers regarding compensation.
PANews13 September 2026
White-hat bounty deadline passed. Outcome of negotiation, final loss total, patch status, and post-mortem publication had not been publicly confirmed as of this investigation date.
AVOID.NET investigation (unresolved as of 2026-09-13)Decision Log
- hash: 5TG3EeJLbQjLG2DcEGFXzm5HiP95zmjoMkcbumgr1nE3
This investigation is cryptographically anchored to the Solana blockchain (1 event). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/13/2026, 12:04:39 PM
last updated: 9/14/2026, 1:17:47 AM
3 viewsavoid.net — verified advice for a post-truth world