Symbiosis DeFi bridge loses $770,000 after admin-privilege bug lets hacker mint 46 billion fake BTC

On September 11, an attacker exploited two flaws in Symbiosis Finance's smart contracts: a hidden privilege-escalation bug granting fake admin rights, and a missing check that allowed negative transaction fees. Using just 330 satoshi, roughly 25 cents, the attacker set fees to negative values across 12 transactions, minting 46 billion wrapped syBTC tokens on a network meant to represent real Bitcoin. They then sold the fabricated tokens against legitimate wrapped-BTC pairs like WBTC and cbBTC, draining liquidity pools and converting about $336,000 into cash via Uniswap before being blocked.