Symbiosis Says It Recovered 15 BTC After Bridge Exploit

Cross-chain protocol Symbiosis says it recovered approximately 15 BTC following an exploit that affected its native Bitcoin Bridge on September 11.

The project reported that the recovered funds are held in a team-controlled multisignature wallet. It also offered a 20% white-hat bounty for additional returned funds or information leading to recovery.

The bridge remains an open incident

Symbiosis halted routes connected to its native Bitcoin Bridge after identifying the affected product. The project said other routes across EVM networks, Tron and TON, along with its Octopools product, remained operational.

Bitcoin swaps were later restored through third-party routing partners Chainflip and THORChain, according to the project account. That restoration does not mean the affected native bridge itself has returned to service.

Symbiosis said it was contacting affected liquidity providers and developing a compensation framework. Final loss accounting and the eligibility criteria for compensation had not been published at the observation time.

Minted supply and realized loss are different measures

Blockchain security firm Blockaid separately reported that the exploit involved the minting of roughly 46.1 billion unbacked syBTC on BNB Chain. That nominal token quantity should not be treated as the economic loss.

The attacker reportedly converted only a small fraction of the unauthorized supply, with an estimated realized amount near $336,000. The gap illustrates why bridge incidents require separate accounting for tokens minted, collateral exposed, assets extracted, funds recovered and remaining user claims.

Recovery is not resolution

Recovering 15 BTC is material, but it does not by itself explain the vulnerability, prove that every attack path is closed or establish that affected users will be made whole.

A complete resolution would require a technical postmortem, final asset reconciliation, verifiable disposition of recovered funds, compensation terms and evidence that any restored native bridge has been independently reviewed.

Sources and disclosures

The recovery, route status and bounty are Symbiosis-reported. The Block provides corroborating reporting and attributes the unauthorized-mint assessment to Blockaid. Blue Rogues has not independently audited the exploit contracts or recovery wallet.

Update note

Observed September 15, 2026 at 10:55 BRT. The native Bitcoin Bridge remained reported as paused and the final compensation framework was pending.