Symbiosis Bridge Halted After 46.1 Billion Fake syBTC Minted
The two bugs turned a deposit-check error into a balance error, so the bridge's own accounting created syBTC with no Bitcoin behind it, and the halt plus the planned audit leave the bridge's resumption date open.
Reporting from 1 source: GIGAZINE.
On September 11, an attacker minted roughly 46.1 billion syBTC on the cross-chain protocol Symbiosis using about 25 cents of Bitcoin. Before the attack, only 13.91 syBTC existed. Symbiosis says two bugs caused it: one misidentified the sender as an administrator, and another let a negative fee increase the deposit amount. Blockaid says the attacker sold about 4.39 WBTC on Uniswap v4 for roughly $336,000. Symbiosis estimates about $770,000 in provisional losses.
The attacker spread the work across 12 fraudulent deposit transactions on BNB Chain, Ethereum, and Rootstock in about four minutes, according to blockchain data confirmed by CoinDesk. Symbiosis's report traces the failure to two separate faults: the deposit confirmation process checked the wrong part of the Bitcoin transaction and treated the attacker as the bridge administrator, which let the minimum fee be set below zero, and the fee deduction then added to the deposit instead of subtracting from it. The syBTC issued in the attack has no backing of real Bitcoin, so extracting value required swapping it for assets held elsewhere.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.