A hacker turned roughly 25 cents of bitcoin into about 46 billion fake BTC tokens on a DeFi bridge, exploiting Symbiosis' Bitcoin Bridge on September 11, 2026, in an incident where a token co
A hacker turned roughly 25 cents of bitcoin into about 46 billion fake BTC tokens on a DeFi bridge, exploiting Symbiosis' Bitcoin Bridge on September 11, 2026, in an incident where a token count that dwarfs Bitcoin's supply says nothing about the attacker's realizable proceeds or the actual losses.
The affected product is the Symbiosis Bitcoin Bridge, and the protocol's official post-mortem dates the incident to September 11, 2026. CoinDesk reported that approximately 46.1 billion unbacked syBTC were created, citing blockchain data it reviewed. For related coverage, see XStocks Surpasses $1 Billion in DEX Trading Volume.
Symbiosis says two flaws combined. An attacker-controlled portion of Bitcoin transaction data was incorrectly used to identify the sender, letting the attacker impersonate an authorized depositor and the portal administrator. For related coverage, see Gate Integrates Arc; Trenches to Support Zero-Gas Trading.
The starting input was a 330-satoshi Bitcoin deposit, worth about 25 cents by CoinDesk's approximate conversion. Symbiosis says the attacker set the minimum portal fee below zero, and subtraction of an unchecked negative fee inflated the credited deposit, enabling arbitrary syBTC minting. For related coverage, see Balancer Proposes Wind Down as Turnaround Plan Fails to Lift Revenue.
Starting Bitcoin deposit
330 satoshi
Symbiosis says a 330-satoshi Bitcoin deposit enabled arbitrary syBTC minting after the attacker exploited sender identification and unchecked negative-fee arithmetic.Source: Symbiosis official post-mortem. Incident date: September 11, 2026.The keys here are the units. The 25 cents describes the value of the bitcoin input; the 46 billion describes the number of fake tokens minted. Neither figure implies the other's worth. This puts the event in the same category as the bridge and DeFi attacks that continue to make waves even as other crypto crime declines. For related coverage, see ARK Invest Sells $64 Million in Crypto-Related Holdings.
The official report records twelve malicious deposits across BNB Smart Chain, Ethereum and Rootstock in roughly four minutes. Symbiosis reports approximately 13.91 syBTC total supply before the incident, with 11.26 syBTC in pools paired with BTCB, cbBTC, WBTC and RBTC.
The output is explicitly fake syBTC minted on a DeFi bridge, not native bitcoin. Bitcoin's protocol caps supply at 21 million coins, and fraudulent bridge tokens do not alter that ledger or touch the underlying asset.
Multiplying 46.1 billion tokens by Bitcoin's spot price is meaningless, because the tokens were only ever redeemable against the bridge's limited liquidity. Symbiosis estimates preliminary losses among liquidity providers and affected users at 9.97 BTC, a figure distinct from the quantity of unbacked tokens minted.
Preliminary losses
9.97 BTC
Symbiosis estimates losses among liquidity providers and affected users at 9.97 BTC. This preliminary estimate is distinct from the quantity of unbacked syBTC minted; final accounting and completed reimbursement are not established.Source: Symbiosis official post-mortem. Incident date: September 11, 2026.The token count alone establishes neither realizable value nor losses. It is a symptom of the minting bug, not a measure of stolen funds.
Symbiosis says Bitcoin payouts to the attacker never completed, and approximately 15.2 BTC of portal funds were evacuated to reserve addresses within hours, where the protocol says they remain untouched. Neither flaw, the protocol noted, was sufficient on its own.
— Symbiosis (@symbiosis_fi) September 14, 2026
Source: @symbiosis_fi on X
Symbiosis intends to cover stolen funds partly from evacuated reserves and offer each liquidity provider an individual compensation plan, though completed reimbursement is not established. The white-hat window closed without a response, and a 20% offer now applies to information leading to recovery.
Symbiosis says its Bitcoin-side logic is being rewritten and independently audited before reactivation, with a separate audit of the entire system commissioned. Final loss accounting, completed reimbursements and finished audit reports are the next items to watch, alongside any explorer-level confirmation of the disputed 46.1 billion figure, which this reporting has not independently reproduced on-chain.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on coinlive.me
