A vast liability, limited liquidity
Blockchain security firm Blockaid said the attacker used a vulnerability in Symbiosis’s BridgeV2 contract on BNB Chain to mint roughly 46.1 billion unbacked syBTC tokens to a newly created address. That figure exceeds Bitcoin’s maximum supply by more than 2,000 times.
The headline number, however, does not represent the attacker’s profit. Blockaid said the attacker appears to have sold only about 4.39 WBTC through Uniswap v4 on Ethereum, receiving approximately $336,000. The gap reflects a basic feature of token bridges: a contract can create claims on an asset far faster than markets can absorb or redeem them.
An exploiter still faces practical constraints. Available liquidity may be shallow, automated market makers can sharply reduce the price of a suspicious token, and centralized exchanges may block deposits or freeze related accounts. Redemptions also depend on whether the bridge holds genuine reserves and whether its operators can stop withdrawals quickly.
Containment becomes the real test
Symbiosis said it paused its native Bitcoin routes and isolated the affected bridge. Other routes across EVM networks, TRON and TON, along with its Octopools product, remained operational. The protocol later restored Bitcoin swaps through third party providers Chainflip and THORChain, while keeping its proprietary Bitcoin Bridge paused.
The company said the recovered 15 BTC, valued at about $1.15 million at the time of reporting, is held in a team controlled multisig wallet. It is contacting affected liquidity providers individually and developing a compensation framework.
That response raises questions beyond the technical exploit. Users must determine whether an alternative route offers genuine risk reduction or merely shifts reliance to another bridge, provider or governance system. A paused contract may stop further losses, but it does not restore confidence or resolve claims by liquidity providers.
The policy problem
Symbiosis has offered the attacker a 20% white hat bounty for returning remaining funds. Such offers can accelerate recovery, but they also create a difficult precedent. They may reward unauthorized access while encouraging protocols to treat post exploit negotiation as part of their security model.
A separate recent Liquid Network incident involving unbacked LBTC shows that the industry’s key measure is not the quantity of counterfeit tokens alone. It is how quickly teams detect abnormal issuance, restrict redemption, communicate with users and establish accountability. For regulators and institutional participants, those controls increasingly matter as much as the bridge’s code.
Sarah Thompson is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Sarah Thompson's usual length and in Sarah Thompson's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Without human check
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.