At about 04:28 UTC on Sep. 11, a transaction that Symbiosis’s BridgeV2 system accepted as properly signed minted roughly 2^62 raw units of syBTC into a wallet that had been created moments earlier on BNB Chain. That’s security firm Blockaid’s account of the exploit, and the number is trillions of times more synthetic bitcoin than any legitimate deposit could back.
syBTC is the protocol’s synthetic representation of bitcoin. Mint enough of it out of nothing and the paper balance stops meaning anything. What matters is how much of it someone can turn into real assets before the exits close.
Not much, as it turns out. Blockaid said the same beneficiary sold about 4.39 WBTC on Ethereum, realizing roughly $336,000 in WBTC proceeds at the time of its alert.
That $336,000 is the only hard conversion figure anyone has published. It covers value Blockaid observed the attacker move, and Blockaid was careful to say it doesn’t establish Symbiosis’s final loss or the total exposure of liquidity providers. Two very different numbers are sitting behind the same incident, and only one of them has been disclosed.
15 BTC is back, and nobody will say out of how much
Symbiosis, the cross-chain protocol that runs the bridge, said it recovered approximately 15 BTC and that the coins are secured in a team-controlled multisig. The protocol said final accounting remained in progress and that it would publish confirmed figures in another update.
Read the 15 BTC for what it is. It’s the amount recovered to date, not a settlement, not a net loss figure, and not a denominator. Without a stated total, a recovery number is a fraction with the bottom half missing.
The bridge is still off, the detours aren’t
Symbiosis said only the Bitcoin Bridge was affected and that its other routes and components stayed operational. It specifically listed routes spanning EVM chains, TRON and TON as unaffected, and said its relayer group continued operating to secure the network.
Bitcoin swaps were pulled first while updates went out. In a later operational update, the protocol said Bitcoin swaps routed through partners Chainflip and THORChain were back online, while the native Symbiosis Bitcoin Bridge remained paused.
That distinction decides what you can do today. Partner-routed Bitcoin swaps work, according to Symbiosis. The native bridge doesn’t, and the protocol hasn’t announced its return. The split keeps traffic off the paused bridge while users take the alternative routes.
Liquidity providers are the ones still waiting
Symbiosis said it was contacting every affected liquidity provider directly and building a compensation framework, with criteria to follow. It has not disclosed who will qualify, how compensation will be calculated or when payments could begin.
Three unknowns, all of them the ones that determine whether an LP gets made whole. A commitment to build a framework isn’t a commitment to a payout, and the gap between the two is where depositors in past bridge incidents have spent months.
A bounty window with no clock on it
The protocol offered the attacker a 20% white-hat bounty through Sep. 13. After that window, Symbiosis said the same percentage would be offered to anyone providing information that leads to recovery.
The statement did not specify an exact cutoff time or timezone. For a deadline aimed at someone deciding whether to hand back funds, that’s a strange thing to leave vague.
Markets shrugged, as they usually do when the damage stays contained to one protocol’s plumbing. Bitcoin is +0.23% over the past 24 hours and sits at rank #1 by market cap.
If you provided liquidity to the native Bitcoin Bridge, the only thing worth tracking is Symbiosis’s next accounting post, and specifically whether it contains three things: confirmed loss and exposure figures, compensation criteria, and a status change on the bridge. Until those land, the 15 BTC is a running total and Blockaid’s $336,000 is a snapshot of one attacker’s sell side. Neither is the bill.
