GoKawiilSymbiosis DeFi bridge loses $770,000 after admin-privilege bug lets hacker mint 46 billion fake BTC
On September 11, an attacker exploited two flaws in Symbiosis Finance's smart contracts: a hidden privilege-escalation bug granting fake admin rights, and a missing check that allowed negative transaction fees. Using just 330 satoshi, roughly 25 cents, the attacker set fees to negative values across 12 transactions, minting 46 billion wrapped syBTC tokens on a network meant to represent real Bitcoin. They then sold the fabricated tokens against legitimate wrapped-BTC pairs like WBTC and cbBTC, draining liquidity pools and converting about $336,000 into cash via Uniswap before being blocked.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident underscores how cross-chain bridges and wrapped-asset protocols remain prime targets because a single unchecked input, like fee sign validation, can be weaponized to fabricate value out of nothing. Even though security firms flagged and froze much of the stolen tokens, victims still face real losses while recovery depends on voluntary return or legal action, highlighting the limited recourse available in decentralized systems.
- A missing sign check on transaction fees let a hacker mint 46 billion fake syBTC tokens for pennies.
- The exploit drained liquidity pools of legitimate wrapped Bitcoin variants, causing $770,000 in damage.
- Only about $336,000 was cashed out before exchanges and security firms flagged the remaining stolen funds.
Source: tomshardware.com — Bruno Ferreira, 2026-09-18
Published there as: “Hacker turns 25 cents into 46 billion fake Bitcoins to steal $770,000 — Symbiosis DeFi exchange bit by lack of basic bounds checking in smart contract”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.