Invest 1 publisher2 min readPublished September 13, 2026 at 3:47 PM PDT

An attacker turned Symbiosis's $46.1 billion mint into $336,000 on Uniswap V4

A BridgeV2 flaw let an attacker mint about 2^62 unbacked syBTC, of which 4.39 WBTC got sold before Blockaid flagged it. Symbiosis has halted BTC routing and recovered 15 BTC into a multisig wallet.

The Investor · Invest desk

Illustration accompanying An attacker turned Symbiosis's $46.1 billion mint into $336,000 on Uniswap V4

What happened

A flaw in Symbiosis's BridgeV2 contract let an attacker mint roughly 2^62 raw units of unbacked syBTC, a quantity whose notional face value was put at around $46.1 billion.
The attacker converted about 4.39 WBTC on Ethereum's Uniswap V4 and took away roughly $336,000 in real money.
Symbiosis halted all BTC-related routing and the native Bitcoin Bridge was still dark on September 13 with no restart timeline published, while its other cross-chain routes kept running.

Compiled by The InvestorSomething wrong?How this is made

Why it matters

constraint Audits by Decurity, Zokyo, SlowMist and Omniscia and several years of clean mainnet operation preceded the mint flaw. Anyone underwriting bridge risk cannot price it off an audit list.
cost Symbiosis is negotiating compensation with affected liquidity providers one at a time while its own loss figure is still being calculated. The bill is being set case by case before the total is known.
contradiction The account says available liquidity capped the damage. Whether it was the market or the halt that stopped the attacker is still an open question.
capability A third-party monitor, not the protocol, triggered the response. That puts outside surveillance firms in the position of deciding how long a mint bug runs.

Divide $46.1 billion by 2^62 raw units and each unit comes to about one hundred-millionth of a dollar, which is $1 for every 100 million units minted ^[1]^[1]. That number is an accounting unit. The sale has a real price in it: 4.39 WBTC for roughly $336,000 implies about $76,500 a coin ^[3]^[2]. The ratio between the two is roughly 137,000 to one ^[3].

What bounded the loss was the exit. Blockaid, an on-chain security firm, identified the suspicious activity before Symbiosis said anything in public. The report says that compressed the window for further extraction ^[4]. Cryptobriefing says available liquidity capped the real damage, and argues the notional measures what a BridgeV2-class flaw would do against deeper pools ^[11]. Cryptobriefing did not disclose the depth of the Uniswap V4 pool the attacker sold into ^[13].

There are two readings and they price differently. If pool depth was the binding constraint, the same flaw against a deeper venue produces a loss in the millions, and the notional is worth treating as a sizing exercise. If detection was binding, $336,000 is a floor set by response time. Discovery came at about 04:28 UTC on September 11 ^[2]; Symbiosis then halted all BTC-related routing ^[5] and recovered roughly 15 BTC connected to the exploit, about 3.4 times the 4.39 WBTC already sold, or some $1.15 million at the implied price ^[6]^[4]^[6]. Fifteen coins still being reachable after the sale is consistent with the second reading, and in my view it is the better one, at least until someone publishes the pool depth.

Then the bounty. Symbiosis offered 20% on recovered or returned funds with a September 13 deadline ^[7], and the 15 BTC now in a multisig wallet is covered by that description ^[6]: 3 BTC, about $229,000 at the price the attacker's own sale implied, against the $336,000 already taken ^[5]. As of September 13 there was no confirmed public response from the attacker ^[8]. The offer then becomes a reward for anyone with information useful to further recovery ^[7].

Final loss calculations are not finished, and affected liquidity providers are being contacted individually about a compensation framework ^[9]. Decurity, Zokyo, SlowMist and Omniscia had all audited the protocol, which had run on mainnet for several years without a significant security incident ^[10]. Cryptobriefing places the episode in a recent run of unbacked minting events across wrapped and synthetic Bitcoin ^[12].

What to watch

The final loss number Symbiosis publishes and what the individual liquidity-provider settlements actually pay.
Whether anyone discloses the Uniswap V4 depth the attacker sold into; that figure settles the liquidity-ceiling question.
Whether the native Bitcoin Bridge restarts, on what contract, and under whose review.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
A vulnerability in Symbiosis's BridgeV2 contract let the attacker mint unbacked syBTC, approximately 2^62 raw units, with a notional face value of around $46.1 billion.
ReportedSupportedView cited source
[2]
The attacker hit Symbiosis's native Bitcoin Bridge on September 11, 2026, and the breach was discovered at approximately 04:28 UTC.
ReportedSupportedView cited source
[3]
The attacker converted roughly 4.39 WBTC on Ethereum's Uniswap V4, walking away with about $336,000 in real money.
ReportedSupportedView cited source
[4]
Blockaid, an on-chain security firm, identified the suspicious activity before Symbiosis made any public announcement, which helped compress the window for further extraction.
ReportedSupportedView cited source
[5]
Symbiosis halted all BTC-related routing across the protocol while other cross-chain routes remained fully operational, and the native Bitcoin Bridge stayed dark as of September 13 with no confirmed restart timeline published.
ReportedSupportedView cited source
[6]
Symbiosis recovered approximately 15 BTC from the exploit and secured those funds in a multisig wallet, which requires multiple private keys to authorize any transaction.
ReportedSupportedView cited source
[7]
Symbiosis offered a 20% bounty on recovered or returned funds with a deadline of September 13, 2026, and indicated that if the attacker ignored the offer the bounty would shift to anyone providing information useful enough to aid further recovery.
ReportedSupportedView cited source
[8]
As of September 13, Symbiosis had not received a confirmed public response from the attacker.
ReportedSupportedView cited source
[9]
Symbiosis said final loss calculations were still being finalized and that affected liquidity providers were being contacted individually to work out a compensation framework.
ReportedSupportedView cited source
[10]
Prior to the exploit the protocol had a clean audit history, with partnership audits conducted by firms including Decurity, Zokyo, SlowMist and Omniscia, and had operated on mainnet for several years without any significant security incidents.
ReportedSupportedView cited source
[d1]
The reported notional works out to about one hundred-millionth of a dollar per raw unit minted, or $1 per 100 million raw units.
DerivedSupported1 source— sign in to open
[d2]
The attacker's sale implies a realized price of about $76,500 per BTC.
DerivedSupported1 source— sign in to open
[d3]
The notional mint is roughly 137,000 times the realized loss.
DerivedSupported1 source— sign in to open
[d4]
The 15 BTC recovered is about 3.4 times the 4.39 WBTC the attacker sold.
DerivedSupported1 source— sign in to open
[d5]
A 20% bounty applied to the 15 BTC recovered is 3 BTC, about $229,000 at the price implied by the attacker's own sale, against the $336,000 realized.
DerivedSupported1 source— sign in to open
[d6]
The 15 BTC recovered is worth about $1.15 million at the price implied by the attacker's sale.
DerivedSupported1 source— sign in to open
[11]
Cryptobriefing wrote that the $336,000 in realized losses illustrates how the ceiling on actual damage is set by available liquidity, while the $46.1 billion notional exposure shows how catastrophic a BridgeV2-class vulnerability could be against deeper liquidity pools.
ReportedInsufficientSource: cryptobriefing.com2 sources— sign in to open View cited source
[13]
The report does not state the depth of the Uniswap V4 liquidity the attacker sold into.
ReportedInsufficient2 sources— sign in to open View cited source
[12]
Cryptobriefing wrote that the incident adds to a recent string of unbacked minting events involving synthetic and wrapped Bitcoin representations, framing it as a systemic issue rather than a one-off engineering mistake.
ReportedInsufficientSource: cryptobriefing.comView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

cryptobriefing.com
1 article · September 13, 2026
Symbiosis recovers 15 BTC after Bitcoin Bridge exploit, offers attacker 20% bounty

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Cryptobriefing names the contract and the four firms that audited Symbiosis before the mint, and that is as close to a cause as our coverage gets. Symbiosis has not published the specific flaw in BridgeV2 that allowed the unbacked mint, and it has not disclosed what those audits actually covered. The instructive part for anyone writing mint-and-redeem logic is that supply control failed completely and the realized loss still stopped at 4.39 WBTC, because that was what the pool would absorb. It was the market's limited depth that capped the damage, not any safeguard in the contract.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence38

0100

One outlet relaying the exploited protocol

The 2^62 mint, the 4.39 WBTC sale, the 15 BTC recovered and the multisig all reach the reader through Cryptobriefing relaying Symbiosis. Symbiosis has published no post-mortem and no transaction or address for anyone to check on a block explorer, and Blockaid has not commented directly. The dates and amounts are specific and they divide out consistently, which is why this sits where it does rather than lower.

AdoptionInsufficient

No measure of what the bridge carried

Nothing here says how much this bridge was used: no routed volume, no value locked, no count of affected liquidity providers. Symbiosis is contacting those providers one at a time and says the loss tally is unfinished, so any usage number we published would be invented.

Hype gap+32

−100 understated0 aligned+100 overstated

Headline notional, footnote loss

The $46.1 billion leads the story and the $336,000 arrives three paragraphs later. Cryptobriefing does not bury the small number and says outright that actual damage was far more contained. Still, the notional values each raw minted unit at one hundred-millionth of a dollar, which is not a price any Bitcoin representation trades at, so the big figure mainly reports how large an integer the contract accepted. The systemic-pattern framing carries the same weakness: no other incident is named.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

invest
Symbiosis's attacker turned 2^62 fake syBTC into 4.39 real WBTC
1 publisher
product
Japan's instant settlement plan starts by tokenising the Bank of Japan, not the bonds
1 publisher
invest
Robinhood Chain's first month: a stock-token network that traded cats
1 publisher
invest
A Connecticut judge just priced prompt injection: no fine, no e-filing
2 publishers

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Perspective Coverage

Reality