Symbiosis Bridge Exploited: Two Bugs Turned 25 Cents Into 46 Billion Fake Bitcoin Tokens
Two software bugs in Symbiosis' Bitcoin Bridge allowed an attacker to create 46.1 billion unbacked syBTC tokens from a 330-satoshi deposit. The attacker exploited a misreading of transaction data and a negative-fee vulnerability to bypass deposit limits. Symbiosis estimates preliminary losses at 9.97 BTC, approximately $770,000.
An attacker created 46.1 billion syBTC tokens, more than 2,000 times Bitcoin's 21 million coin limit, from a 330-satoshi deposit worth approximately 25 cents, according to CoinDesk's reporting on the Symbiosis DeFi bridge exploit. The attacker processed 12 bogus deposits across BNB Chain, Ethereum, and Rootstock in roughly four minutes.
Two compounding software flaws enabled the attack. The first bug caused the bridge to read the wrong part of a bitcoin transaction when deciding who had sent money, allowing the attacker to be treated as both an approved depositor and the bridge administrator. The second bug permitted the attacker to use that elevated access to push the bridge's minimum fee below zero, according to CoinDesk. When a negative fee is subtracted from a deposit amount, the math flips: instead of reducing the deposit, subtraction adds to it, allowing the attacker to represent their 330-satoshi deposit as worth essentially any number they supplied.
The token creation alone did not produce equivalent losses. Creating unbacked bridge tokens does not create the real assets needed to redeem them; the attacker could extract value only from actual bitcoin-linked liquidity on the other side. Before the attack, syBTC supply stood at 13.91 tokens, with 11.26 sitting in liquidity pools paired with WBTC, cbBTC, BTCB, and RBTC. Symbiosis estimated preliminary losses at 9.97 BTC, approximately $770,000, per CoinDesk.
Symbiosis holds approximately $8 million in total value locked, despite processing roughly $146 million of bridge volume over the past 30 completed days. The protocol has committed to covering stolen funds using bitcoin evacuated during the attack and separate compensation arrangements for affected liquidity providers, according to CoinDesk. Symbiosis' Bitcoin Bridge remains offline while the Bitcoin-side software is rewritten and independently audited.
The post-mortem acknowledged AI as part of a changing security environment, stating that powerful models are making software vulnerabilities cheaper to find, though it did not indicate whether there was evidence the attacker used AI. Symbiosis commissioned a broader audit of the system beyond the Bitcoin Bridge rewrite.
A $0.25 deposit became 46.1 billion fake tokens exceeding Bitcoin's entire supply by 2,000 times, limited only by actual liquidity available to extract.
Symbiosis' bridge is offline through rewrite and independent audit, expected to resume after security review. The $8 million TVL and preliminary $770,000 loss figure will shift as the protocol's full accounting of extracted value surfaces and as compensation mechanisms are deployed across affected liquidity pools.
Ranked, source-checked, and verified by the desk's independent review pass.