Symbiosis recovers 15 BTC from bridge exploit; LP compensation terms pending
In brief
- Symbiosis recovered ~15 BTC after attacker exploited native Bitcoin Bridge on September 11 at 04:28 UTC
- Attacker minted 2^62 syBTC units and sold ~4.39 WBTC for approximately $336,000 in proceeds
- Native bridge remains paused; Chainflip and THORChain partner routes restored online
- Symbiosis offers 20% bounty through September 13 but has not disclosed LP compensation framework
The Attack and Recovery
Symbiosis recovered approximately 15 BTC after an attacker exploited its native Bitcoin Bridge. The vulnerability was exploited at approximately 04:28 UTC on September 11, according to the protocol's incident statement. Only the Bitcoin Bridge was affected; other routes and components remained operational.
The attacker's method was straightforward but devastating. A transaction minted approximately 2^62 raw units of syBTC to a newly created wallet on BNB Chain. The attacker then moved quickly to convert stolen assets into fiat value. The attacker sold approximately 4.39 WBTC on Ethereum, realizing roughly $336,000 in proceeds.
Bridge Status and Bounty Window
Bitcoin swaps routed through partners Chainflip and THORChain were back online, while the native Symbiosis Bitcoin Bridge remained paused. The recovered bitcoin is secured in a team-controlled multisig.
Symbiosis is offering the attacker a path to keep a portion of the stolen funds. The protocol offered the attacker a 20% white-hat bounty through September 13. After that window, Symbiosis said the same percentage would be offered to anyone providing information that leads to recovery.
Liquidity Provider Compensation Status
The bigger gap remains compensation for liquidity providers who funded the bridge. Symbiosis said it was contacting every affected liquidity provider directly and building a compensation framework. Yet concrete terms are still missing. Symbiosis has not disclosed who will qualify for compensation, how compensation will be calculated, or when payments could begin.
Final accounting for the attack remained in progress at the time of reporting, with Symbiosis promising to publish confirmed figures in a follow-up update.
