Hacker turns 25 cents of Bitcoin into 46 billion fake BTC tokens on Symbiosis bridge

Someone took a quarter's worth of Bitcoin and turned it into a notional $46.1 billion in synthetic tokens. The actual haul was considerably more modest, around $336,000, but the mechanics of the exploit reveal just how fragile cross-chain bridge infrastructure remains.

On September 11, the Symbiosis Bitcoin Bridge suffered a critical vulnerability in its BridgeV2 smart contract on BNB Chain. The attacker minted approximately 46.1 billion syBTC tokens, synthetic assets designed to represent actual Bitcoin deposits, without providing any real backing whatsoever.

The syBTC token is supposed to function as a 1:1 representation of Bitcoin held in custody by the bridge protocol. The attacker essentially printed 46.1 billion coat check tickets without ever walking in with a jacket.

That notional face value of over $46.1 billion would represent more than 2,000 times the total circulating supply of Bitcoin.

Instead of trying to dump billions in fake synthetic Bitcoin, the hacker took a surgical approach. They liquidated approximately 4.39 WBTC through Uniswap v4 on Ethereum, walking away with roughly $336,000 in actual proceeds. The minted tokens were initially sent to a freshly created externally owned account, a move that blockchain security firm Blockaid flagged almost immediately via its monitoring systems.