A hacker reportedly turned about 25 cents of bitcoin into roughly 46 billion fake BTC tokens on a DeFi bridge, an eye-catching figure that overstates the real damage because the minted tokens
A hacker reportedly turned about 25 cents of bitcoin into roughly 46 billion fake BTC tokens on a DeFi bridge, an eye-catching figure that overstates the real damage because the minted tokens are not native bitcoin and the confirmed loss is far smaller. The scale of the mint is startling, but the money at stake, according to the protocol involved, runs to single-digit bitcoin rather than billions.
The incident traces to Symbiosis, a cross-chain protocol whose Bitcoin Bridge was exploited on September 11, 2026, according to the project's official postmortem. The document is timestamped September 14, 2026. For related coverage, see McHenry Says Senate Will Vote to Advance Crypto CLARITY Act.
Symbiosis says the attacker deposited just 330 satoshi and used it to mint an arbitrary amount of syBTC, the bridge's bitcoin-representing token. That deposit was worth about 25 cents at report-time value, according to CoinDesk's incident report. For related coverage, see CLARITY Act Fails to Advance in the Senate.
Initial exploit deposit
330 satoshi
Symbiosis says a 330-satoshi deposit triggered arbitrary syBTC minting through two interacting software flaws. This is the deposit size, not the amount stolen.CoinDesk, which reviewed on-chain activity, reported that roughly 46.1 billion unbacked syBTC were created. That headline figure is a rounded token count, not native bitcoin created and not assets stolen; the exact unrounded total has not been independently reconciled with published transaction hashes. For related coverage, see CLARITY Act Senate Floor Test Needs 60 Votes to Advance.
The mint did not come from a single click. Symbiosis says 12 malicious deposits were processed across BNB Chain (BSC), Ethereum and Rootstock in roughly four minutes, spreading the fake tokens across three networks.
Key Takeaway
syBTC is a bridge token that claims to represent bitcoin held in the protocol's custody, not bitcoin itself. Native bitcoin supply is capped at 21 million coins and cannot be inflated by a smart-contract bug on another chain.
Minting billions of a bridge token does not conjure backing for them. Symbiosis reports it held roughly 13.91 syBTC in supply before the incident and 11.26 syBTC of liquidity in pools paired with BTCB, cbBTC, WBTC and RBTC, a tiny fraction of the tokens the attacker generated.
That gap is the whole point: a token label or an enormous quantity alone does not demonstrate real bitcoin backing or realizable value. Multiplying 46 billion syBTC by bitcoin's price would be meaningless, because there was never anywhere near that much bitcoin to redeem against.
The confusion mirrors debates over confidential and wrapped assets elsewhere in DeFi, such as Tether's move to bring USD₮ onto privacy-focused infrastructure and Zama's expansion into Morpho vaults with confidential contracts, where the representation of an asset and the asset itself are distinct things.
Symbiosis attributes the exploit to two interacting software flaws. It says its decoder used attacker-controlled transaction data to identify the sender, allowing the attacker to impersonate an authorised depositor and the portal administrator.
The second flaw involved fees. Symbiosis says the attacker set the minimum portal fee below zero, and subtracting an unchecked negative fee inflated the credited deposit. The protocol stated that neither flaw was sufficient on its own.
Symbiosis put preliminary losses to liquidity providers and affected users at 9.97 BTC, described by CoinDesk as roughly $770,000 at report-time value. The protocol frames this as a preliminary estimate, not an independently reconciled final loss.
Preliminary loss estimate
9.97 BTC
Symbiosis estimates losses to liquidity providers and affected users at 9.97 BTC. This preliminary protocol estimate is not a final independently reconciled loss or the number of unbacked syBTC tokens minted.On containment, Symbiosis says bitcoin payouts to the attacker never completed, and roughly 15.2 BTC of portal funds were evacuated to reserve addresses within hours. Evacuated reserves are a safeguard, not evidence that any user has yet been made whole.
The bull case for affected users rests on that response. Symbiosis says it intends to cover stolen funds, partly from the evacuated reserves, and to offer individual compensation plans to liquidity providers, though it has not reported any completed reimbursement.
The bear case is that key facts are still open. Symbiosis says its white-hat window closed without a response and that a 20% offer now applies to information leading to recovery, an outcome that is far from guaranteed.
The protocol says its Bitcoin-side logic is being rewritten and will receive an independent audit before reactivation, and that it has commissioned a full-system audit. No relaunch date, audit findings, or completed compensation have been established.
One widely circulated angle should be treated cautiously. The postmortem discusses how AI is lowering the cost of discovering bugs in general, but there is no evidence this attacker used AI, so any such claim rests on unconfirmed reports rather than established fact.
Symbiosis summed up the dual-bug nature of the exploit in its own words in the postmortem, published to X:
— Symbiosis (@symbiosis_fi) September 14, 2026
Source: @symbiosis_fi on X
For readers, the takeaway is a matter of scale and definitions. The 46 billion figure measures fabricated bridge tokens; the money genuinely at risk, on the protocol's own preliminary numbers, sits in the single-digit-BTC range, with recovery and audits still pending.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on coinwy.comRead also :
