An exploit hit Symbiosis's BTC Bridge, enabling the minting of massive unbacked syBTC, with the attacker ultimately cashing out about 336,000 worth of actual wrapped BTC (WBTC) on Ethereum.

Blockaid’s monitoring showed the bridge minted an enormous amount of raw syBTC to a fresh wallet and the attacker dumped about 4.39 WBTC on Ethereum’s Uniswap V4, illustrating the scale of fake BTC representation.

The root flaw lay in BridgeV2 on BNB Chain, which allowed minting of roughly 2^62 syBTC (about 46.1 billion units) due to accepting a bad cross-chain message.

Final loss figures and the bridge’s status are still being audited and reconciled as the investigation proceeds.

The incident underscores the risk to liquidity providers in cross-chain systems, where recoveries may not fully compensate all affected users.

Symbiosis says it is contacting affected liquidity providers directly and is building a compensation framework, with criteria to be announced.

The compensation framework details—eligibility, calculation, and payment timelines—have not yet been disclosed, while losses are being confirmed.

Symbiosis plans to publish confirmed loss figures after completing its investigation and is notifying providers as it develops the framework.

Prudent user steps include inventorying bridged tokens, testing exits, revoking unlimited approvals, and choosing withdrawal destinations in case of disruption.

Users should verify token contract addresses, perform small test withdrawals, revoke unused approvals, and decide whether funds go to a wallet or exchange during a potential outage.

The incident fits a broader pattern of cross-chain bridge exploits, with recent breaches and recoveries noted across other networks.

DefiLlama data show about $8 million in total value locked and roughly $146 million in bridge volume over the last 30 days, signaling meaningful disruption despite modest pre-incident TVL.