Symbiosis Bridge Exploited to Mint 46.1 Billion syBTC with 330 Satoshis

Cross-chain protocol Symbiosis revealed that an attacker exploited a vulnerability in its Bitcoin Bridge, depositing just 330 satoshis (approximately $0.25) of Bitcoin (BTC) to mint 46.1 billion uncollateralized syBTC. Initial losses were estimated at 9.97 BTC, or about $770,000 (roughly 1 billion KRW). Symbiosis stated in a post-mortem analysis that the attacker executed 12 fraudulent deposits over approximately four minutes across BNB Chain, Ethereum, and Rootstock.

The bridge misread an incorrect field in Bitcoin transactions during user identification, causing the attacker to be recognized as both an approved depositor and bridge administrator. Symbiosis also disclosed that the attacker manipulated negative transaction fees, which resulted in increased deposit amounts when fees were deducted—a second vulnerability exploited in the attack. Prior to the incident, syBTC supply stood at 13.91 units, with 11.26 units held in WBTC, cbBTC, BTCB, and RBTC liquidity pools.