Bitcoin: Symbiosis recovers 15 BTC after bridge hacking

Symbiosis recovers approximately 15 BTC after Bitcoin bridging breach

The cross-chain liquidity protocol Symbiosis successfully recovered approximately 15 bitcoins after its Bitcoin bridging service was exploited. The September 11 incident prompted the project to suspend Bitcoin bridging services and quarantine affected infrastructure. At the same time, with support from Chainflip and ThorChain, Symbiosis restored some Bitcoin trading functions. The agreement also announced a 20% reward to recover the remaining funds. This action took place against the backdrop of large-scale generation of non-endorsement tokens by multiple bridging platforms.

Event Summary

• On September 11, Symbiosis Bitcoin Bridge was attacked and approximately 15 BTC were subsequently recovered.
• The agreement continues to suspend its native Bitcoin bridge service, but restores some redemption capabilities through Chainflip and ThorChain.
• The attack resulted in the generation of 46.1 billion unendorsed syBTC tokens, but only approximately $336,000 is believed to have been withdrawn.
• Symbiosis is offering a 20% reward to recover the remaining funds held by hackers.

Attack details and contingency measures

According to an official statement from Symbiosis, an attacker exploited a vulnerability in its bridging protocol on September 11. However, the project party did not elaborate on the specific nature of the attack. After discovering the vulnerability, the team immediately interrupted its native Bitcoin routing and isolated the affected bridge components. Other protocol services remain operating normally.

Routing on the EVM, TRON, and TON networks and the Octopowers function remain online, and the relay network continues to operate. Currently, Symbiosis has restored Bitcoin redemption channels through Chainflip and ThorChain, but its own Bitcoin bridging service is still suspended.

Symbiosis said it is working closely with relevant liquidity providers and is preparing a compensation framework. It is reported that about 15 recovered BTC pieces were deposited in a multi-signature wallet with a value of approximately US$1.15 million at current prices.

Reward mechanism and asset recovery

To speed up asset returns, Symbiosis announced a 20% reward for stolen funds. The reward is valid for attackers until September 13; after that date, anyone who can provide information that can help recover funds will receive the same reward.

The amount currently recovered is only a portion of the assets related to the incident. Symbiosis has locked the 15 BTC found in multi-signature wallets and continues to coordinate with affected service providers to accommodate future compensation plans.

There is a significant difference between the issuance of huge coins and the actual losses

This case also involves the generation of billions of unendorsed syBTC tokens. Blockaid previously warned that a vulnerability was detected on BNB Chain: a call to the Symbiosis Bridge V2 contract generated approximately 46.1 billion syBTC. The tokens were then sent to a new address. It is worth noting that the number of tokens generated far exceeds the total limit of 21 million bitcoins.

Despite such a large-scale token offering, Blockaid pointed out that the suspected attacker only sold approximately 4.39 WBTC units on Ethereum Uniswap v4, making a profit of approximately $336,000. DeFiLlama classified the incident as an "unsecured cross-chain token creation" with a loss of $336,000. It can be seen that there is a huge gap between the number of tokens issued theoretically and the actual funds withdrawn.

Industry precedents and comparisons

The case of Symbiosis is reminiscent of the Liquid protocol that was attacked not long ago. At the time, hackers created about 4000 unendorsed LBTC and exchanged them for Bitcoin held on the Internet, and subsequently returned about 3400 BTC. However, Blockstream refused to pay a reward for the approximately 598.5 BTC remaining in circulation.

Other bridging attack incidents have also shown similar differences between theoretical circulation and actual revenue. In April this year, an attacker used the Hyperbridge bridge protocol designed specifically for Polkadot to create 1 billion DOT tokens, but ultimately made a profit of only about $237,000, well below the theoretical value of the tokens. These precedents suggest that the generated tokens are not equivalent to actual withdrawable funds.

Agreement status and future outlook

Symbiosis claims to have facilitated more than US$10 billion in deals since it was launched five years ago. According to DeFiLlama, the agreement currently has a total locked value (TVL) of approximately US$7 million, with bridging transaction volume of approximately US$3.19 billion.

Future focus will focus on assets that have not yet been recovered and Symbiosis announced compensation framework for affected service providers. For BTC users, the primary challenge right now is ensuring the security of funds before the Bitcoin Bridge service is restored. The next steps will assess the final damage and respond to affected parties.