Kucoin Symbiosis Bridge Exploit Mints $46B in Synthetic Bitcoin
Article Content
- •An attacker exploited the Symbiosis Bitcoin Bridge, minting $46.1 billion in syBTC.
- •Only $336,000 was converted to real assets, highlighting a significant gap in losses.
- •Symbiosis has halted BTC routing and offered a bounty for the recovery of stolen funds.
On September 11, 2026, an attacker exploited a vulnerability in the Symbiosis Bitcoin Bridge, minting approximately 2^62 raw units of syBTC, valued at $46.1 billion, but only converting $336,000 into real assets. The attack was facilitated by a message validation failure in the BridgeV2 contract, which allowed the minting of synthetic Bitcoin without corresponding real BTC backing. Symbiosis halted all BTC routing immediately after detecting the exploit, while other routes remained operational. The incident follows a recent breach in Blockstream's Liquid Network, raising concerns about the security of cross-chain bridges. Symbiosis has since recovered 15 BTC and offered a 20% bounty to the attacker for the return of the remaining funds. The incident is classified under DCI-2026-304 in the Delta Incident Archive.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (29)
Following this threat?
Track Blockstream in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…