Around 04:28 UTC on Sep. 11, Symbiosis’s BridgeV2 accepted a transaction it read as correctly signed and issued roughly 2^62 raw units of syBTC to a wallet that had been spun up only minutes before on BNB Chain. Security firm Blockaid laid out that sequence, and the figure represents trillions of times more synthetic bitcoin than any real deposit could ever collateralize.
Within the protocol, syBTC stands in for bitcoin. Conjure enough of it from nothing and the balance on paper becomes meaningless. The question that counts is how much of that supply an attacker can convert into real assets before the doors shut.
As it happens, the answer was modest. According to Blockaid, the same beneficiary offloaded about 4.39 WBTC on Ethereum, which worked out to roughly $336,000 in WBTC proceeds as of the firm’s alert.
So far, that $336,000 is the only firm conversion number in the public record. It reflects value Blockaid watched the attacker shift, and the firm took pains to note that it does not pin down Symbiosis’s eventual loss or the full exposure carried by liquidity providers. One incident, two very different totals — and only one has been made public.
15 BTC is back, and nobody will say out of how much
Symbiosis, the cross-chain protocol behind the bridge, reported recovering approximately 15 BTC, now held in a multisig the team controls. The protocol added that final accounting was still underway and that confirmed figures would come in a subsequent update.
Take the 15 BTC at face value: it is the sum recovered so far, not a settlement, not a net loss, and not a denominator. Absent a stated total, a recovery figure is a fraction missing its bottom half.
The bridge is still off, the detours aren’t
The protocol maintains that the damage was confined to the Bitcoin Bridge, with its remaining routes and components still running. Routes covering EVM chains, TRON and TON were named specifically as unaffected, and Symbiosis said its relayer group kept operating to secure the network.
Bitcoin swaps were the first thing taken down while updates rolled out. A later operational note said Bitcoin swaps running through partners Chainflip and THORChain had been restored, though the native Symbiosis Bitcoin Bridge was still paused.
That line determines what is usable right now. Partner-routed Bitcoin swaps function, per Symbiosis. The native bridge does not, and no return date has been announced. The arrangement steers traffic away from the paused bridge and toward the alternatives.
Liquidity providers are the ones still waiting
Symbiosis said it was reaching out individually to each affected liquidity provider and putting together a compensation framework, with criteria still to come. Who qualifies, how the amounts get calculated and when any payments might start all remain undisclosed.
Those three blanks are precisely the ones that decide whether an LP ends up whole. Pledging to build a framework is not the same as pledging a payout, and that distance is where depositors caught in earlier bridge incidents have lost months.
A bounty window with no clock on it
A 20% white-hat bounty was put on the table for the attacker, running through Sep. 13. Once that window closes, Symbiosis said the same percentage would go to anyone whose information leads to recovery.
No precise cutoff time or timezone was given. For a deadline pitched at someone weighing whether to return funds, leaving that undefined is an odd choice.
Markets barely reacted, the usual response when the fallout stays inside one protocol’s plumbing. Bitcoin is +0.23% over the past 24 hours and holds rank #1 by market cap.
Anyone who supplied liquidity to the native Bitcoin Bridge should be watching one thing only: Symbiosis’s next accounting post, and whether it delivers three items — confirmed loss and exposure figures, compensation criteria, and a status update on the bridge. Until then, the 15 BTC is a running tally and Blockaid’s $336,000 is a snapshot of one attacker’s selling. Neither amounts to the bill.