Hacker creates 46 billion fake BTC tokens on Symbiosis with just $0.25

Traders Union
All News
Crypto
Hacker creates fake BTC

Two bugs allowed billions of syBTC to be created

According to Symbiosis' incident report, the first vulnerability was in the mechanism used to identify the sender of a Bitcoin transaction. The bridge analyzed the wrong part of the transaction, allowing the attacker to make the system recognize them as both an authorized user and the bridge administrator.

After gaining elevated privileges, the hacker set the minimum fee below zero. A second bug then came into play: when calculating the amount, the system subtracted the negative fee from the deposit, effectively adding it instead.

This allowed the initial 330 satoshis to be turned into an arbitrarily large amount inside the system. Blockchain data shows that the attacker processed 12 fake deposits across BNB Chain, Ethereum and Rootstock in four minutes, ultimately creating around 46.1 billion syBTC.

However, creating billions of unbacked tokens did not produce an equivalent amount of real Bitcoin. The hacker could extract only the real assets available in liquidity pools, limiting the actual losses to less than 10 BTC.

Symbiosis shuts down Bitcoin Bridge

Symbiosis estimates the total value of assets locked in the protocol at around $8 million. Over the last 30 completed days, approximately $146 million passed through the bridge.

The project said it plans to compensate for the stolen funds using some of the Bitcoin moved to safety during the attack, along with separate reimbursement mechanisms for affected liquidity providers. The Bitcoin Bridge remains offline while the team rewrites the software and prepares it for an independent audit.

A day earlier, a Gnosis Safe wallet owner lost around 2,900 rsETH worth $7.8 million due to a flaw in the authorization mechanism of a helper smart contract. Researchers found that the vulnerability was not in Safe's core contracts but in a third-party component that the user had authorized to access the assets.

In that case, a flawed permission check allowed a transaction involving the wallet's assets to be executed. The incident provided another example of how a vulnerability in a contract connected to a wallet can cause losses without the wallet itself being compromised.

Earlier, we reported that crypto projects lost nearly $1 billion to hacks in the first half of 2026. The figures included protocol exploits and other security incidents that resulted in the theft of digital assets.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.