Symbiosis Pauses BTC Routing After Bridge Vulnerability Lets Attacker Mint syBTC

Blockchain security platform Blockaid said a vulnerability in Symbiosis' Bitcoin bridge allowed an attacker to mint about 2^62 syBTC to a newly created externally owned account and sell about 4.39 WBTC on Ethereum's Uniswap V4. The attacker realized about $336,000, according to Odaily. Symbiosis said the attack occurred at around 4:28 on September 11 and that its team has paused BTC routing. Other routes remain operational and were not affected. The team said it recovered about 15 bitcoins and deposited them into a multisig wallet controlled by the team, and it offered the attacker a white-hat bounty equal to 20% of the funds, with a deadline of September 13. Symbiosis has not yet published a BridgeV2 technical postmortem, disclosed final losses, or confirmed whether the attacker accepted the bounty. The incident follows similar security events at Liquid Network and Nomic in recent weeks.