A hacker has executed a remarkable exploit, turning just 25 cents worth of Bitcoin into an astonishing 46 billion fake BTC tokens through a decentralized finance (DeFi) bridge. This incident highlights significant vulnerabilities in the Symbiosis platform.

Exploiting Bugs in Symbiosis' Bitcoin Bridge

The attacker took advantage of two critical software flaws in the Symbiosis Bitcoin Bridge, enabling them to create over 2,000 times the total supply of Bitcoin in unbacked syBTC tokens. This operation began with a modest deposit of 330 satoshis, equating to approximately 25 cents, which was manipulated through 12 fraudulent transactions across multiple blockchains, including BNB Chain, Ethereum, and Rootstock. The vulnerabilities allowed the hacker to gain elevated privileges, misrepresenting their identity as both an authorized depositor and the administrator of the bridge. By setting the minimum transaction fee to a negative value, the hacker exploited a second bug that mishandled fees, effectively inflating their deposit amount without any actual backing. Before the exploit, the total supply of syBTC was a mere 13.91 tokens, with minimal liquidity available. The preliminary losses from this incident have been estimated at approximately 9.97 BTC, roughly $770,000, impacting liquidity providers and users on the platform. Despite the massive number of fake tokens generated, the hacker could only access the actual Bitcoin-linked liquidity, limiting their ability to extract value. In response to the attack, Symbiosis has temporarily disabled its Bitcoin Bridge to conduct a comprehensive audit and rewrite its software. The platform has also pledged to compensate affected users using some of the Bitcoin that was transferred during the hack. Currently, Symbiosis maintains about $8 million in total value locked, although it has seen significant bridge volume in recent weeks. The incident underscores the ongoing challenges in securing DeFi platforms, as highlighted by the post-mortem analysis, which noted the increasing role of AI in identifying software vulnerabilities. However, it remains unclear if AI tools were employed by the hacker during this exploit.