On 11 September 2026, around 04:28 UTC, the Bitcoin bridge of Symbiosis fails. A contract, BridgeV2, accepts a message that corresponds to no bitcoin deposit. It still mints syBTC, a token meant to stand for bitcoin on other chains. The face is huge. The haul is not.

Blockaid sees the exploit underway on BNB Chain, publishes the addresses. At 06:11 UTC Symbiosis cuts bitcoin swaps. At 07:17 the team confirms: the “BTC portal” is hit. EVM, TRON, TON routes, Octopools: intact, it says.

What was created

On BNB Chain a signed `receiveRequestV2Signed` operation creates about 46.1 billion syBTC (8 decimals) to a brand-new account. DeFiLlama files it as an unbacked mint (DCI-2026-304). Other counts, aggregating several chains, show a higher minted volume. That is not a second attack. It is the same one, seen with another rule.

Those units are not bitcoin. Nobody was going to buy tens of billions of synthetics with no reserve. Only the pocket that was actually there, here WBTC, could leave. The beneficiary sells about 4.39 on Uniswap v4, Ethereum. Nearly $336,000. The pattern recalls Liquid and Nomic: inflate a wrapped token, monetise what the pools hold.

What did not move

The rest of the stack continues. Relayers up. Bridge isolated. In the day, bitcoin swaps resume through partners: Chainflip, THORChain. The native bridge stays down. On 12 September, syBTC exits were still possible one way, while deposits to the bridge were frozen. A partial halt. Not an extinction.

What the team says it took back

At 16:04 UTC on the 11th, Symbiosis announces about 15 BTC recovered, on a team multisig, and a 20% white-hat bounty until 13 September. After that window, the same bounty applies to anyone who leads to a recovery. On 14 September final accounting is not closed. Hashes for those 15 bitcoin have not been published so as to check everything. The Block reports it that way: said, not yet independently matched.

For liquidity providers, $336,000 extracted is not the only figure. A mint without a reserve breaks the parity between syBTC in circulation and BTC in the vault. The team says it is contacting each affected LP and preparing a framework. On 13-14 September the criteria were not public. No detailed technical post-mortem of BridgeV2 either.

On 14 September

Exploit confirmed on the 11th at 04:28 UTC. Mass mint of unbacked syBTC. Real extraction of about 4.39 WBTC. Non-bitcoin routes operational. Native bridge still paused. 20% bounty rolled into an information reward after the 13th. No closed net loss for LPs. No post-mortem. No advice to put funds back in.

A bitcoin bridge depends on a message: “the bitcoin arrived”. If the message is wrongly accepted, synthetic supply no longer has a link to the reserve. Bitcoin’s ledger minted nothing.