A flaw in Symbiosis’ BridgeV2 on the BNB Chain allowed the minting of a massive amount of synthetic Bitcoin (syBTC) without backing, roughly 46.1 billion units, after a bad message was accepted.

Blockaid’s report shows the bridge minted about 2^62 raw syBTC to a fresh externally owned account, and the attacker dumped roughly 4.39 WBTC on Ethereum Uni V4, illustrating the scale of fake Bitcoin representation on the system.

The attack enabled the minting of billions of unbacked syBTC, with the attacker eventually cashing out around $336,000 in actual wrapped BTC (WBTC).

Final loss figures and the bridge’s status remain pending as the incident undergoes a full audit and accounting by the protocol.

The incident underscores risk for liquidity providers in cross-chain systems, where asset recovery may not fully compensate affected users.

Symbiosis reports the supply chain is secured but recovery methods are not finalized; they are engaging central exchanges to suspend MTR and MTRG deposits and withdrawals.

Prudent steps for users include inventorying bridged tokens, revoking unlimited approvals, testing small withdrawals, verifying token contracts, and deciding on withdrawal destinations in case of disruption.

Users should proactively check bridged holdings and perform small test withdrawals, verify addresses to avoid counterfeits, revoke unused approvals, and plan where funds will go if disruption continues.

The incident is placed in the broader context of ongoing cross-chain bridge exploits, alongside breaches and partial recoveries at other bridges.

Symbiosis says it is notifying affected liquidity providers and is developing a compensation framework, with loss figures, eligibility, and payment timelines to be published after the investigation.

The project is engaging affected liquidity providers and will publish confirmed loss figures and compensation criteria once the investigation progresses.

Symbiosis has halted native Bitcoin routing, begun notifying providers, and is preparing a compensation framework, with details to follow.