The Bitcoin cross-chain bridge of Symbiosis has recently been exploited. The project team released a post-attack analysis stating that the attackers used only a deposit of 330聪, approximately equivalent to 0.25 US dollars in Bitcoin, to initiate 12 fake deposits within about 4 minutes, minting around 46.1 billion syBTC tokens that are not backed by any actual assets.
Two vulnerabilities combined to amplify the attack
According to the project team, the issue stems from two software defects. The first vulnerability occurs in the identification process of Bitcoin transaction senders. The bridging system read incorrect transaction fields, which led to attackers being mistakenly identified by the system as authorized depositors, and they also obtained administrative privileges for the bridge.
After obtaining higher privileges, the attacker exploited a second vulnerability to set the minimum transaction fee for the bridge to a negative value. The system then "deducted" this negative fee from the deposit amount, which actually resulted in an increase in the total amount, allowing the attacker to input an extremely large coinage value out of nowhere.
The scale of forgery far exceeds the upper limit of Bitcoin.
On-chain data shows that these 12 fraudulent deposits were distributed across BNB Chain, Ethereum, and Rootstock. The total amount of syBTC generated in the end was approximately 46.1 billion coins, which is more than 2,000 times higher than Bitcoin's theoretical upper limit of 21 million coins.
However, the forged syBTC does not equate to real losses of the same magnitude. The reason is that such cross-chain bridge tokens can only be redeemed when there are real assets backing them. Although attackers can mint a large number of uncollateralized tokens, the actual value they can obtain is still limited by the actual Bitcoin-related liquidity in the other pool.
The preliminary loss is 9.97 BTC.
According to the project team, before the attack, the total supply of syBTC was only 13.91 coins, of which 11.26 coins were distributed in liquidity pools paired with WBTC, cbBTC, BTCB, and RBTC. Symbiosis currently estimates the preliminary loss for liquidity providers and affected users to be 9.97 coins of BTC, which, calculated at the price around the time of the report, is approximately 770,000 US dollars.
The project team stated that they will use some of the Bitcoin that was transferred during the attack, along with separate compensation arrangements, to cover the stolen funds. Their native Bitcoin cross-chain bridge has been temporarily taken offline, and the project is in the process of rewriting the Bitcoin-related software. They have also entrusted an independent institution to conduct an audit and have initiated a more comprehensive system review.
Additional information:According to DefiLlama data, Symbiosis currently has a total locked-up value of about 8 million US dollars, and the volume of cross-chain transactions processed within the past 30 natural days is approximately 146 million US dollars.
