coindesk.com
Printing 46 billion fake bitcoin $BTC$76,250.30-linked tokens on cross-chain application Symbiosis started with a deposit of just 330 satoshi, the smallest unit of bitcoin, worth about 25 cents in total.
The service lets users swap tokens across blockchains where they may not originally be supported. A post-mortem published early Tuesday shows how two software flaws in the Symbiosis’ Bitcoin Bridge combined to let an attacker create enormous amounts of syBTC, a token meant to represent bitcoin held by the system.
Blockchain data reviewed by CoinDesk shows the attacker processed 12 bogus deposits across BNB Chain, Ethereum and Rootstock in roughly four minutes, eventually creating about 46.1 billion syBTC, or more than 2,000 times Bitcoin's 21 million coin limit.
The bridge looked at the wrong part of a bitcoin transaction when deciding who had sent the money, allowing the attacker to persuade the system to treat them as both an approved depositor and the bridge administrator, according to Symbiosis.
That elevated access let the attacker push the bridge's minimum fee below zero. A second bug then subtracted the negative fee from the deposit amount, which added to it rather than reducing it — meaning the deposit could suddenly be treated as worth essentially whatever number the attacker supplied.
Symbiosis said syBTC supply stood at just 13.91 tokens before the attack, with 11.26 syBTC sitting in liquidity pools paired with WBTC, cbBTC, BTCB and RBTC. Its preliminary estimate puts losses to liquidity providers and affected users at 9.97 $BTC, or about $770,000.
The discrepancy between the number of tokens created and the actual loss stems from a feature of the process. Coining unbacked bridge tokens does not make the real assets needed to redeem them. The attacker could extract value only from whatever actual bitcoin-linked liquidity was sitting on the other side.
Symbiosis currently holds about $8 million in total value locked, according to DefiLlama, despite processing roughly $146 million of bridge volume over the past 30 completed days.
The project said it plans to cover the stolen funds using some of the bitcoin evacuated during the attack and separate compensation arrangements for affected liquidity providers.
Its native Bitcoin Bridge remains offline while the Bitcoin-side software is rewritten and independently audited. Symbiosis also commissioned a broader audit of the system.