Symbiosis recovers 15 BTC after attacker mints billions of syBTC

Cross-chain liquidity protocol Symbiosis has recovered approximately 15 BTC after an attacker exploited its Bitcoin Bridge, while its native bitcoin route remains suspended and affected liquidity providers await a compensation plan. Summary Symbiosis recovered approximately 15 BTC after an attacker exploited its Bitcoin Bridge on Sept. 11. The protocol offered a 20% bounty for further fund recovery while its native Bitcoin Bridge remains paused. Blockaid said the exploit minted roughly 46.1 billion unbacked syBTC, but the attacker sold only around 4.39 WBTC for $336,000. Bitcoin swaps have resumed through Chainflip and THORChain while Symbiosis prepares a compensation framework for affected liquidity providers. Symbiosis said the security incident occurred on Sept. 11 after an attacker exploited a vulnerability in the Bitcoin Bridge, prompting the protocol to halt its native BTC routes and isolate the affected bridge from the rest of its infrastructure. Symbiosis experienced a security incident. At approximately 04:28 UTC on Sep 11, 2026, attacker exploited a vulnerability in Bitcoin Bridge. BTC routes have been halted. Other routes remain operational and safe. Where we stand: • Only the Bitcoin Bridge was affected, and it is… — Symbiosis (@symbiosis_fi) September 11, 2026 The recovered bitcoin has been moved to a team-controlled multisig wallet. Symbiosis has not disclosed a final loss figure, saying its accounting work is still underway as it contacts liquidity providers affected by the incident. The protocol initially offered the attacker a white-hat bounty equal to 20% of the funds if the remaining assets were returned by Sept. 13. Symbiosis said that after the deadline, the same 20% reward would be offered to anyone who provides information that leads to further fund recovery. Symbiosis Bitcoin Bridge remains paused The exploit was limited to Symbiosis’ native Bitcoin Bridge, according to the protocol, while routes involving EVM networks, TRON and TON continued to operate. Its Octopools product and relayer network remained online during the response. Bitcoin swaps have since resumed through third-party integrations with Chainflip and THORChain, giving users an alternative route while the protocol keeps its own bridge offline. Symbiosis has not given a date for restoring the native Bitcoin Bridge. The team has said it is working with security researchers and assessing the final impact before providing further details. You might also like: Chainflip loses 736,442 USDT in TRON exploit The protocol had processed more than $10 billion in transactions since launching roughly five years ago. DefiLlama data cited in the original report placed its total value locked at around $7 million, while recorded bridge volume stood at approximately $3.19 billion since the data series began. Attention has since turned to liquidity providers exposed through the Bitcoin route.