Symbiosis 2026 BridgeV2 syBTC incident
On September 11, 2026, Blockaid-derived reports identified anomalous Symbiosis BridgeV2-signed syBTC activity on BNB Smart Chain. The beneficiary later sold about 4.39 WBTC on Ethereum for roughly $336,000. Root cause and final loss remain unresolved.
Incident facts
- Incident title
- Symbiosis 2026 BridgeV2 syBTC incident
- Bridge
- Symbiosis
- Incident date
- 2026-09-11
- Incident type
- Exploit
- Major incident
- No
- Affected chains
- BNB Chain, Ethereum
- Affected assets
- WBTC, Unknown
- Attack category
- Unknown
- Reported loss
- About $336,000 realized; final loss unresolved
- Amount confidence
- Medium
- Loss amount basis
- Reported By News
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Unknown
- Current outcome
- Unknown
- Postmortem
- Not Found
- Resolution
- Unresolved
- Last reviewed
- 2026-09-11
- Last verified
- 2026-09-11
Amount and valuation
Two contemporaneous reports citing Blockaid monitoring state that the beneficiary sold approximately 4.39 WBTC on Ethereum Uni V4 and had cashed out about $336,000 at the reporting horizon. BIR treats this as a lower-bound realized amount rather than a verified final protocol loss.
The approximately $336,000 figure describes reported realized WBTC cash-out at an early incident horizon. The enormous nominal syBTC quantity is not treated as realized loss, and larger circulating loss estimates are not promoted without stronger corroboration.
approximately 4.39 WBTC sold on Ethereum Uni V4approximately $336,000 cashed out
Used as a lower-bound realized amount, not a verified final protocol loss.
Why this remains unresolved
- The underlying compromise mechanism and whether signing authority itself was compromised are not established by the admitted evidence.
- The final direct protocol loss is not established; only an early realized WBTC cash-out amount is corroborated.
- Recovery, reimbursement, and attacker-fund disposition are not established by the admitted evidence.
- A first-party incident statement establishing any service pause, restart, or final operational scope has not yet been admitted.
Timeline events
BridgeV2-signed syBTC anomaly followed by WBTC cash-out2026-09-11
Security-monitoring reports described a BridgeV2-signed transaction on BNB Smart Chain transferring an anomalously large raw syBTC amount to a newly created EOA. The same beneficiary later sold approximately 4.39 WBTC on Ethereum Uni V4. The underlying exploit path and total final loss remained unresolved at the reviewed evidence horizon.
The nominal raw syBTC amount is not converted into canonical loss. No signing-key or MPC compromise is inferred.
Evidence records
- Bitcoin bridge: bridge native BTC to DeFi & EthereumSymbiosis Finance · Tier 1 · High reliability · primary · 2024-09-23Claim scope: Bridge Entity
First-party architecture and scope authority for the Symbiosis native Bitcoin bridge, syBTC settlement role, BNB/EVM support, relayer network and MPC-threshold-signature context. It is linked to the incident package only as architecture/context evidence and does not prove the September 2026 exploit or its root cause.
- Symbiosis Cross-Chain Protocol Attacked on BSC; 33.6K USD WBTC StolenKuCoin News · Tier 2 · Medium reliability · secondary · 2026-09-11Claim scope: Incident Case
Contemporaneous aggregation citing Blockaid/MetaEra/Foresight reporting. The body states approximately 4.39 WBTC was sold on Ethereum Uni V4 and about $336,000 was cashed out. The headline says 33.6K, so BIR follows the repeated body figure only as a lower-bound reported realization, not a verified final loss.
- 461億美元syBTC疑遭違規鑄造 Symbiosis Finance在BSC遇駭TokenPost · Tier 2 · Medium reliability · secondary · 2026-09-11Claim scope: Incident Case
Independent contemporaneous report citing Blockaid monitoring and corroborating the anomalous syBTC activity and approximately $336,000 realized cash-out. It explicitly states that the attack path, later loss scale and Symbiosis response were not yet confirmed.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- Exact root cause and initial access path.
- Final realized and unrecovered loss.
- Whether the affected path was formally paused and, if so, the restart boundary.
- Final recovery or reimbursement outcome.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.