Symbiosis says it has recovered 15 BTC and offers a reward of 20%

Cross-chain protocol Symbiosis said it recovered about 15 BTC in the Bitcoin Bridge vulnerability incident and provided a 20% bonus to the attacker.

Cross-chain protocol Symbiosis said that after its Bitcoin Bridge was exploited, it has successfully recovered about 15 Bitcoin (BTC) and provided the attacker with a reward equivalent to 20% of the total funds. This security incident once again focuses on the risks of cross-chain infrastructure, which is of particular concern for Southeast Asian traders who rely heavily on cross-chain channels to transfer value between local exchanges.

For regional users from Jakarta to Manila, cross-chain bridges are not niche tools, but infrastructure to connect assets. It connects assets stored on platforms such as Indodax, Tokocrypto or Coins.ph to external DeFi liquidity. Any vulnerability in this infrastructure directly threatens all users of BTC across links.

The amount claimed to be recovered and the details of the incident

According to an official statement released by Symbiosis on the X platform, the attacker exploited its Bitcoin Bridge vulnerability at around 04:28 a.m. UTC on September 11, 2026. Symbiosis's description of the incident is a unilateral version that has not been independently confirmed on the chain.

The team said it had recovered approximately 15 BTC and deposited the funds into a multi-signature wallet controlled by the team. However, the declaration does not include the transaction hash or the multi-signed address, so this recycling result cannot be verified through the blockchain browser at present.

Summary of Key Points

• Symbiosis claims to have recovered approximately 15 BTC.
• This recall report follows the Bitcoin Bridge exploit incident.
• Symbiosis offers attackers a reward of 20% of their funds.

It is worth noting that the amount recovered is not equal to the total loss. Symbiosis said the final accounting is still in progress and the confirmed data will be released in subsequent updates, so 15 BTC should not be considered a full recovery.

The protocol party stated that BTC routing has been suspended, the Bitcoin Bridge has been isolated, and its other components such as EVM, TRON, TON, and Octopowers are unaffected and operating normally. This is the team's assessment conclusion, not the result of an independent safety audit. Even if overall market prices are stable, bridging events will repeatedly shake market sentiment, just as Bitcoin has recently fluctuated between whale buy signals and macro fear signals.

Event statement released by Symbiosis

Symbiosis experienced a security incident. At approximately 04:28 UTC on September 11, 2026, the attacker exploited a vulnerability in the Bitcoin Bridge. BTC routing has been suspended. Other routes remain operational and secure.

Our current situation:

·Only Bitcoin Bridge has been affected and has... - Symbiosis (@symbiosis_fi) September 11, 2026

Details on providing 20% bounty to attackers

Symbiosis said it had made a "white hat" offer to attackers to pay 20% of the funds involved in return, which is valid until September 13, 2026. The statement did not specify a specific deadline or time zone, nor did it confirm whether the attacker accepted the offer.

Explanation of the bounty calculation base:

Although the bounty points to the attacker, its calculation base is not clearly stated. The 20% mentioned in the statement is part of the "funds", but the specific value is not defined in terms of BTC or US dollars, so it should not be understood as a share of the 15 BTC recovered.

Two-stage structure:

Symbiosis points out that after the window period for attackers ends, anyone who provides information that leads to the recovery of funds will also receive a 20% reward. This transformed the nature of the transaction from a "white hat settlement" to an "informant reward," a two-stage structure that is increasingly common in negotiated hacking event recovery.

and existing vulnerability bounty programs:

The bounty offer for this specific event is separate from the agreement's regular vulnerability bounty program. The existing Immunefi vulnerability bounty program has a maximum reward of $100,000, and a fixed reward of $100,000 for key smart contracts (the project was released on August 18, 2022, and was most recently updated on November 14, 2024), and requires proof-of-concept and fix recommendations for critical reports. The two should not be confused.

Issues to be clarified: Total loss and recovery verification

The biggest unknown currently lies in the total amount of the loss and any remaining differences. Symbiosis said that the accounting is in progress and did not specify the total amount of funds stolen and the proportion of the 15 BTC recovered, so the net loss in the disclosure materials remains unclear.

In addition, the recycling itself has not yet been verified. Since transaction hashes, multi-signed addresses or attacker addresses have not been disclosed, claims that funds are in team-controlled wallets cannot currently be independently verified and should be regarded as an official statement rather than an established fact.

Symbiosis also said it is contacting affected liquidity providers (LPs) and developing a compensation framework, with specific criteria to be determined. Since the completion of reimbursement has not yet been announced, LP's processing plan is still in the planning stage rather than the established result.

These information gaps reflect the limitations of current disclosures and do not prove that relevant details do not exist. Previously, the latest trading price of Bitcoin was about US$76,758, which was basically flat within 24 hours; the fear and greed index of the broad crypto market was 61, which was in the "greedy" range, but these macro indicators did not reflect the market's reaction to this specific event.

Enlightenment for Southeast Asian users

Practical lessons for Southeast Asian platforms and their users are both concrete and true. Regional exchanges such as Tokocrypto and Coins.ph rely heavily on cross-chain infrastructure for routing. Today, the cross-chain risk issues that dominate the macro trading week are accompanied by real-time recovery negotiations waiting to confirm data, becoming a reality that users must face.

Disclaimer: This article is for reference only and does not constitute financial or investment advice. There are significant risks in the cryptocurrency and digital asset markets. Be sure to conduct independent research before making a decision.