Trillions in Fake Bitcoin Minted by Hackers, While 15 BTC Recovery Fails to Repay Liquidity Providers

The native bridge is still paused as the 20% bounty window ends on Sept. 13, while the final accounting process continues.

Cross-chain protocol Symbiosis said about 15 BTC was recovered after an attacker exploited its native Bitcoin Bridge, but affected liquidity providers still have no clear compensation terms as the Sept. 13 bounty window approaches its unspecified deadline.

The exploit was detected at around 04:28 UTC on Sept. 11, according to the protocol’s incident statement. Symbiosis said the issue was limited to its Bitcoin Bridge, while its other routes and components continued operating normally. Routes across EVM chains, TRON and TON were specifically reported as unaffected, with the relayer group remaining active to help protect the network. The recovered bitcoin is being held in a team-controlled multisig, the protocol said.

The 15 BTC represents only the amount Symbiosis says it has recovered so far. The protocol said the final accounting is still underway, with confirmed figures expected to be released in a subsequent update.

Security firm Blockaid reported that Symbiosis’s BridgeV2 system accepted a transaction as validly signed, allowing roughly 2^62 raw units of syBTC, a synthetic bitcoin token, to be minted to a newly created wallet on BNB Chain.

Blockaid said the same beneficiary sold around 4.39 WBTC on Ethereum, generating roughly $336,000 in proceeds when the alert was issued. The amount reflects only the value Blockaid observed being converted by the attacker and does not represent Symbiosis’s final loss or the full exposure faced by liquidity providers.

Bitcoin Swaps Resume Through Partner Routes#

Symbiosis initially reported that Bitcoin-related swaps were unavailable as updates were being rolled out. In a later operational update, the protocol said Bitcoin swaps through partners Chainflip and THORChain had resumed, while its native Symbiosis Bitcoin Bridge remained paused.

That distinction shapes which services users can access. Symbiosis said Bitcoin swaps through partner routes remain available, but it has not announced when the affected bridge will reopen. The separation keeps traffic away from the paused Symbiosis bridge while users continue using alternative Bitcoin routes.

Symbiosis said it was reaching out to all affected liquidity providers individually while developing a compensation plan, with the criteria still to be announced. It has yet to clarify who will be eligible, how payouts will be determined or when compensation might be issued.

The protocol also offered the attacker a 20% white-hat reward until Sept. 13. Once that period ends, Symbiosis said the same reward would be available to anyone whose information helps recover the funds. However, the statement did not provide a specific deadline or timezone.

Affected liquidity providers are now awaiting three key updates: confirmed loss and exposure figures, details of the compensation process, and any change in the native bridge’s status. Until Symbiosis releases those details, the recovered funds and Blockaid’s estimate of converted proceeds should not be viewed as the final loss figure.