The Bitcoin bridge, Symbiosis hack began with an almost comically small deposit: 330 satoshi, worth about 25 cents. Four minutes later, the attacker had created roughly 46.1 billion syBTC, a bitcoin-linked token that was supposed to represent real assets held by the bridge.
That number is more than 2,000 times Bitcoin’s maximum supply of 21 million coins. Of course, the attacker did not actually create billions of bitcoins. They found a way to make a cross-chain system believe that imaginary deposits were real.
Symbiosis operates a service that lets users swap tokens between blockchains where those assets would not otherwise be available. Its Bitcoin Bridge issues syBTC as a representation of bitcoin held by the system.
According to Symbiosis’ post-mortem, two software bugs in that bridge interacted in a particularly damaging way.
The first involved how the system read Bitcoin transactions. Instead of correctly identifying the sender, the bridge checked the wrong part of the transaction. That gave the attacker a way to make the system recognize them as both an authorized depositor and the bridge administrator.
That second identity was the key to everything that followed.
With administrator-level access, the attacker changed the bridge’s minimum fee to a negative number. Normally, a fee reduces the amount credited from a deposit. Here, the software treated the negative fee as something to subtract from the deposit anyway — effectively increasing the amount instead.
That meant the attacker could supply a number that made a tiny Bitcoin deposit appear to represent an enormous amount of syBTC.
The Symbiosis hack was mostly about fake supply
Blockchain data reviewed by CoinDesk shows the attacker made 12 fraudulent deposits across BNB Chain, Ethereum and Rootstock. The transactions unfolded in roughly four minutes, producing about 46.1 billion syBTC.
The absurd supply figure is what makes the Symbiosis hack so striking, but it was not the amount of fake tokens alone that determined the financial damage.
Before the attack, Symbiosis said there were only 13.91 syBTC in circulation. Of those, 11.26 syBTC were held in liquidity pools alongside WBTC, cbBTC, BTCB and RBTC.
Creating unbacked tokens does not create the real Bitcoin needed to redeem them. The attacker could only take value from the actual bitcoin-linked assets available in those pools.
Symbiosis’ preliminary estimate puts the losses to liquidity providers and affected users at 9.97 BTC, worth about $770,000.
The contrast is stark: a quarter-dollar deposit was enough to manufacture tens of billions of tokens on paper, but the attacker could only turn that inflated balance into real value where actual liquidity existed.
The incident also highlights a less visible risk in cross-chain systems. A token can carry the appearance of an asset without containing the asset itself, making the software responsible for maintaining that connection especially consequential.
Symbiosis currently has about $8 million in total value locked, according to DefiLlama, and processed roughly $146 million in bridge volume over the previous 30 completed days.
The project said it plans to reimburse stolen funds using some of the Bitcoin moved out during the attack, along with separate compensation arrangements for affected liquidity providers.
For now, its native Bitcoin Bridge remains offline. Symbiosis said the Bitcoin-side software is being rewritten and will undergo an independent audit, while a broader audit of the system has also been commissioned.
The post-mortem also raised a broader point about software security. Symbiosis said increasingly powerful AI systems are making vulnerabilities cheaper to discover, although it did not provide evidence that AI was used by the attacker in this case.
That leaves the most surreal detail of the Symbiosis Bitcoin Bridge hack intact: the attack started with less than a dollar, created more than 46 billion units of a bitcoin-linked token, and ultimately exposed a much more ordinary weakness — software that trusted the wrong inputs.