Exploiting Two Software Bugs, Attacker Created Over 2,000 Times Bitcoin's Total Supply in Unbacked syBTC; Preliminary Losses Estimated at 9.97 BTC
By Shaurya Malwa|Edited by Sheldon Reback1 hr ago2 min readMake preferred on ShareShare this articleCopy linkX (Twitter)LinkedInFacebookEmailMake preferred on A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge. (Kevin Horvat on Unsplash)SummaryShow- Two software vulnerabilities in Symbiosis’ Bitcoin Bridge allowed the hacker to convert a 330-satoshi deposit into approximately 46.1 billion unbacked syBTC tokens through 12 fraudulent deposits.
- The attacker took advantage of a flaw that granted admin privileges and another that miscalculated fees, enabling unlimited token creation.
- Symbiosis has estimated losses at 9.97 BTC, has committed to compensating affected users, and has temporarily disabled the bridge for a full audit and rewrite.
The creation of 46 billion fake bitcoin-linked tokens occurred on the cross-chain platform Symbiosis, starting with a deposit of just 330 satoshi, which is roughly equivalent to 25 cents.
This platform facilitates token swaps across different blockchains where direct support may not exist. A post-mortem released early Tuesday detailed how two software bugs within Symbiosis’ Bitcoin Bridge combined to enable the hacker to generate vast amounts of syBTC, a token intended to represent Bitcoin held within the system.
According to blockchain analysis from CoinDesk, the hacker executed 12 fraudulent deposits across BNB Chain, Ethereum, and Rootstock in about four minutes, ultimately generating around 46.1 billion syBTC, which exceeds Bitcoin's total supply limit of 21 million coins by more than 2,000 times.
The bridge misidentified the sender of a Bitcoin transaction, allowing the hacker to convince the system to recognize them as both an authorized depositor and the bridge's administrator, as explained by Symbiosis.
This elevated access permitted the hacker to set the bridge's minimum fee to a negative value. A second bug then incorrectly handled this fee, adding it to the deposit amount instead of subtracting it, effectively enabling the hacker to inflate the deposit's value arbitrarily.
A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge. (Shaurya Malwa/CoinDesk)Before the attack, Symbiosis reported that the supply of syBTC was limited to just 13.91 tokens, with 11.26 syBTC in liquidity pools paired with WBTC, cbBTC, BTCB, and RBTC. The preliminary assessment indicates that liquidity providers and affected users suffered losses totaling 9.97 BTC, amounting to approximately $770,000.
The large discrepancy between the number of tokens created and actual losses is attributed to the nature of the process. Creating unbacked bridge tokens does not generate the real assets necessary for redemption; thus, the hacker could only extract value from the actual Bitcoin-linked liquidity present on the platform.
Currently, Symbiosis has around $8 million in total value locked, according to DefiLlama, despite having processed about $146 million in bridge volume over the previous 30 days.
The project has stated its intention to use some of the Bitcoin that was moved during the attack to compensate for the stolen funds, alongside separate arrangements for affected liquidity providers.
The Bitcoin Bridge remains offline while the software related to the Bitcoin side is being rewritten and subjected to an external audit. Additionally, Symbiosis has initiated a broader system audit.
The post-mortem highlighted the role of AI in the evolving security landscape, noting that advanced models are making it easier to identify software vulnerabilities. However, it did not specify whether AI was used by the attacker.
Read More: Bitcoin firms ask AI labs for same tools attackers already have
HackDeFiRelated AssetsBitcoin$75,767.613.48%Latest Crypto News- 1European Central Bank calls for merchants to participate in digital euro pilot45 min ago
- 2Clarity Act's odds of passing plunge as Republicans reject Democrats' counter-proposal47 min ago
- 3Standard Chartered predicts Arbitrum's ARB to rise 70-fold to $10, citing Robinhood Chain revenue1 hr ago
- 4To ensure permanent economic innovation, we must pass the Clarity Act now3 hrs ago
- 5Ether, solana, XRP likely to gain if Clarity Act progresses3 hrs ago
- 6Why banks should stop worrying and learn to love the Clarity Act4 hrs ago
- 7Velocity extends Series A to $48M at $200M valuation with backing from Visa, Circle, and Ripple4 hrs ago
- 8Bitcoin gives back Monday's gain as Clarity Act odds fade on Polymarket4 hrs ago
- 9How a simple coding mistake let a hacker drain $7.8 million from a crypto wallet4 hrs ago
- 10Nigel Farage-backed Stack BTC plans to acquire a gold dealer for $16 million to fund bitcoin buy4 hrs ago
Tokenized Equities Lead RWA Inflows as bStocks Sets the Pace
Tokenized Equities Lead RWA Inflows as bStocks Sets the Pace
Tokenized equities lead RWA inflows as the market recovers; Binance's bStocks hit ~$118.5M in two months, now #2 issuer and ~90% of on-chain equity DEX volume.
By CoinDesk ResearchAug 27, 2026Tokenized equities lead RWA inflows as the market recovers; Binance's bStocks hit ~$118.5M in two months, now #2 issuer and ~90% of on-chain equity DEX volume.
Why it matters:
Tokenized equities lead RWA inflows as the market recovers; Binance's bStocks hit ~$118.5M in two months, now #2 issuer and ~90% of on-chain equity DEX volume.
View Full ReportMore From Tech