Symbiosis Bitcoin bridge exploit: 46 billion fake syBTC minted, 336 thousand dollars taken, 15 BTC recovered — what the record shows

A cross-chain bridge is a piece of software that lets you move value from one blockchain to another by locking it on one side and issuing a matching token on the other. When the issuing side stops checking that the lock really happened, it can create tokens out of nothing. That is what the record says happened to the Symbiosis Bitcoin bridge on 11 September 2026. The headline number, 46 billion, is real but misleading; the money that actually left is a small fraction of it. Here is the timeline as the sources give it.

On 11 September 2026 at 04:28 UTC, according to Crypto Briefing, a vulnerability in Symbiosis's BridgeV2 contract on BNB Chain was found and used. The attacker minted approximately 2 to the power of 62 raw units of syBTC, the bridge's wrapped-Bitcoin token. At Bitcoin's price that notional amount comes to roughly 46.1 billion dollars, which is the figure most headlines carried.

The minted tokens were unbacked: no Bitcoin sat behind them. The Block reports that the on-chain security firm Blockaid classified the incident as an "unbacked cross-chain mint". Crypto Briefing adds that Blockaid identified the suspicious activity before Symbiosis's own public announcement, "which helped compress the window for further extraction."

The attacker could only turn the fake tokens into real value where there was liquidity to absorb them. Crypto Briefing puts the realised damage at about 336 thousand dollars: 4.39 WBTC converted through Uniswap V4. That is the number that matters for the people who lost money, and it is about 0.0007 percent of the headline figure.

On 13 September, at 5:51 PM Eastern time according to The Block, Symbiosis said it had recovered about 15 BTC, worth about 1.15 million dollars at the time, and secured it in a multisig wallet. It offered the attacker a 20 percent bounty on returned funds, with a deadline of 13 September. Crypto Briefing reports that if the attacker declined, the bounty would shift to anyone who provided useful information for recovery.

The Block quotes the protocol's statement to affected liquidity providers: "We are contacting every affected LP directly. We are building a compensation framework and will publish the criteria shortly." No amounts, dates or eligibility rules for that framework had been published as of 13 September.

The Symbiosis Bitcoin bridge itself was halted. Crypto Briefing's wording on 13 September: "The native Bitcoin Bridge stayed dark as of September 13, with no confirmed restart timeline published." The Block reports that Bitcoin swaps were restored through two third-party partners, Chainflip and THORChain, while the protocol's own Bitcoin route remains paused. Routes on EVM networks, TRON and TON were not affected and kept operating.

For scale: The Block gives Symbiosis's total value locked at about 7 million dollars, and cumulative bridge volume at 3.19 billion dollars since its data series began. A protocol of that size can absorb a 336 thousand dollar loss; whether it can absorb the loss of trust is what the coming weeks will show.

The number is a measure of how badly the contract failed, not of how much was stolen. A mint of 2 to the power of 62 units is not a sum anyone would type in; it is a power of two, the kind of number that comes out of a contract's arithmetic, not out of a market. The lesson is about verification. The bridge issued tokens without confirming the corresponding lock, and every other check in the system, including the liquidity pools that eventually limited the damage, only worked because the pools were shallow.

Readers who followed our documentation of Revolut's fake-government-request breach will recognise the pattern: the loss came from a step that looked legitimate and was not checked, not from a broken lock.

We do not run a bridge, hold customer assets or route swaps. Our company publishes sourced data and teaches how these systems work, as set out on the About page. The Crypto Academy is where we teach the basics of how on-chain systems like this one are built; readers who want the daily context around Bitcoin's on-chain state will find it, with sources, on Market Observation. Our book on the Ripple case, available on the Ripple page, covers a different kind of failure, the legal one, but the method is the same: date, source, number.

Whether the attacker accepted the bounty. The criteria and amounts of the compensation framework. The restart date for the native Bitcoin bridge. And a full post-mortem of the BridgeV2 flaw, which neither source had seen published. When any of these is answered we will record it.

• The Block, "Symbiosis says it recovered 15 BTC after Bitcoin bridge exploit, offers attacker 20 percent bounty", 13 September 2026, 5:51 PM EDT (updated 5:55 PM) — the recovery, the bounty, the Symbiosis statement quoted verbatim, Blockaid's classification, TVL and volume figures, Chainflip and THORChain routing.
• Crypto Briefing, "Symbiosis recovers 15 BTC after Bitcoin Bridge exploit, offers attacker 20 percent bounty", 13 September 2026 — the 04:28 UTC timestamp, 2^62 units, 4.39 WBTC via Uniswap V4, the 336 thousand dollar figure, Blockaid's early detection, the "stayed dark" wording.
• CoinTurk News and Blockonomi, 14 September 2026 — corroborating reports of the 46 billion syBTC mint and the 336 thousand dollar loss.

Educational content. Not investment advice.