Symbiosis exploit exposes Bitcoin bridge risk without touching Bitcoin itself

Symbiosis shut down its native Bitcoin bridge on Friday after an attacker exploited its BridgeV2 contract to mint a huge amount of unbacked synthetic BTC. Yet the attacker managed to extract only about $336,000 in real value. The importance of that gap cannot be overlooked. It is important to emphasize that Bitcoin’s security was not compromised, rather it is the infrastructure by which BTC crosses into DeFi that proved to be vulnerable. This incident occurred only days after the Liquid Network breach that resulted in a loss of $320 million, thus making one wonder just how safe the cross-chain infrastructure is after making the observation that Bitcoin is secure, yet its bridges are failing repeatedly. BTC routes halted while the rest of the network stayed open Symbiosis revealed on X that it found evidence of the Bitcoin Bridge attack on September 11 at about 04:28 UTC and stopped BTC routing right away. However, other routing protocols continued to function. In the Delta Incident Archive, the incident is classified as DCI-2026-304, which says that BridgeV2 processed an incorrect message that led to more than 2^62 syBTC being generated on BNB Chain and Ethereum. As a result, the criminal managed to convert a portion of this illegitimate balance into approximately 4.39 WBTC on Ethereum, thereby profiting around $336,000. DeFiLlama classifies the incident as an “Unbacked Cross-Chain Mint.” Where cross-chain trust enters the system Symbiosis documentation shows how heavily the bridge relies on the secure transmission and authentication of cross-chain messages. BridgeV2 connects the protocol’s Portal and Synthesis contracts with its off-chain Relayers Network. Those relayers submit transactions signed through an Multi-Party Computation (MPC) key stored in the contract. Through the use of MPC threshold signatures, native Bitcoin (BTC) is secured in a Portal. This enables relayers to create syBTC on a separate blockchain that is then transformed into the preferred asset of the user. Symbiosis has claimed that their native BTC bridge has undergone an audit through Decurity. This model relies on ensuring that instructions sent across chains are authenticated accurately, which was not the case here. A huge synthetic mint, a small realized loss The large synthetic mint ought not to be confused with the total amount stolen. The minting of more than 2^62 raw syBTC has created a massive imbalance in accounting, but the hacker was able to convert only a small portion of that into real assets. The total loss is estimated to be around $336,000. This brings Symbiosis closer to the bottom of the major hacks of 2026. TRM Labs reports 207 crypto hacks in the first half of the year, the highest semi-annual total in its history, with an average loss of $219,000.