Cross-chain protocol Symbiosis said it recovered approximately 15 BTC after an attacker exploited its native Bitcoin Bridge, though affected liquidity providers have yet to receive compensation details as a bounty period concludes.
The vulnerability was exploited at approximately 04:28 UTC on September 11. According to Symbiosis's incident statement, only the Bitcoin Bridge was affected. The protocol confirmed that other routes spanning EVM chains, TRON, and TON remained operational, and its relayer group continued operating to secure the network.
Security firm Blockaid reported that a transaction accepted as signed by Symbiosis's BridgeV2 system minted approximately 2^62 raw units of syBTC, a synthetic representation of bitcoin, to a newly created wallet on BNB Chain. Blockaid said the attacker subsequently sold about 4.39 WBTC on Ethereum, realizing roughly $336,000 in proceeds at the time of its alert.
Symbiosis stated that the recovered bitcoin is secured in a team-controlled multisig. The protocol emphasized that final accounting remains in progress and said it would publish confirmed figures in an upcoming update. The 15 BTC figure represents the amount recovered to date and should not be treated as a final loss tally.
Service Status and Operations
Bitcoin swaps routed through partner protocols Chainflip and THORChain returned online, while Symbiosis's native Bitcoin Bridge remains paused. This distinction allows users to access alternative Bitcoin routes while the affected bridge undergoes remediation.
Compensation Framework Pending
Symbiosis said it is contacting every affected liquidity provider directly and building a compensation framework with criteria to follow. The protocol has not disclosed which providers will qualify, how compensation will be calculated, or when payments could begin.
Symbiosis offered the attacker a 20% white-hat bounty through September 13. After that window, the protocol said the same percentage would be offered to anyone providing information leading to recovery, though no exact cutoff time or timezone was specified.
Affected liquidity providers are awaiting three key disclosures: confirmed loss and exposure figures, compensation criteria, and any change to the native bridge's operational status.
