Symbiosis exploit exposes Bitcoin bridge risk without touching Bitcoin itself

Symbiosis shut down its native Bitcoin bridge on Friday after an attacker exploited its BridgeV2 contract to mint a huge amount of unbacked synthetic $BTC. Yet the attacker managed to extract only about $336,000 in real value.

The importance of that gap cannot be overlooked. It is important to emphasize that Bitcoin’s security was not compromised, rather it is the infrastructure by which $BTC crosses into DeFi that proved to be vulnerable.

This incident occurred only days after the Liquid Network breach that resulted in a loss of $320 million, thus making one wonder just how safe the cross-chain infrastructure is after making the observation that Bitcoin is secure, yet its bridges are failing repeatedly.

$BTC routes halted while the rest of the network stayed open

Symbiosis revealed on X that it found evidence of the Bitcoin Bridge attack on September 11 at about 04:28 UTC and stopped $BTC routing right away. However, other routing protocols continued to function.

In the Delta Incident Archive, the incident is classified as DCI-2026-304, which says that BridgeV2 processed an incorrect message that led to more than 2^62 syBTC being generated on BNB Chain and Ethereum.

As a result, the criminal managed to convert a portion of this illegitimate balance into approximately 4.39 WBTC on Ethereum, thereby profiting around $336,000. DeFiLlama classifies the incident as an “Unbacked Cross-Chain Mint.”