Crypto Attacker Minted 46 Billion Fake Bitcoin Tokens With a 25-Cent Deposit

source: Shattered

An attacker exploited two software flaws in the Symbiosis cross-chain bridge on September 11, according to CoinDesk, generating roughly 46.1 billion synthetic bitcoin tokens from an initial deposit worth about 25 cents.

Symbiosis is a protocol that lets users swap tokens across blockchains where those assets are not natively supported. The platform issued a post-mortem on Tuesday describing how the attack unfolded.

The attacker deposited 330 satoshis, bitcoin's smallest denomination unit, and processed 12 fraudulent transactions across BNB Chain, Ethereum, and Rootstock in roughly four minutes.

The resulting tokens, called syBTC, are meant to represent actual bitcoin held by the system. Instead, the 46.1 billion minted had no real bitcoin backing them, exceeding Bitcoin's hard-capped supply of 21 million coins by more than 2,000 times.

Two Bugs, One Broken Bridge

Symbiosis attributed the breach to a pair of separate coding errors that compounded each other.

The first caused the bridge to examine the wrong part of an incoming bitcoin transaction when identifying the sender, which allowed the attacker to appear simultaneously as an approved depositor and a bridge administrator.