Cross-chain liquidity protocol Symbiosis said it suffered a security incident after an attacker exploited a vulnerability in its bitcoin bridge at around 04:28 UTC on Sept. 11, 2026. The protocol said its BTC route has been paused, while all other routes remain operational. According to the team, the incident was limited to the bitcoin bridge and has been isolated from the rest of the system. It said routes across EVM chains, TRON and TON were not affected, and that components including Octopools continue to operate normally. Symbiosis also said its relayer set remains online and is maintaining network security. The team said it has recovered about 15 BTC and moved the funds to a multisig wallet under team control. It has offered the attacker a white-hat bounty equal to 20% of the funds until Sept. 13, 2026. After that deadline, the same percentage will be offered to anyone who can provide information that helps recover the assets. Symbiosis said the final loss is still being calculated and that it is contacting affected liquidity providers one by one while preparing a compensation framework.

SlowMist said on X that Liquid Network was hit by a Rangeproof verification cache key collision exploit on Sept. 6. According to the security firm, the attacker minted about 3,998.5 L-BTC without any corresponding BTC peg-in, then converted the tokens into Bitcoin on the main network through peg-out transactions within minutes. After the incident, about 3,400 BTC was returned to the Liquid federation peg wallet, while roughly 598.5 BTC remains under the attacker’s control. SlowMist said the flaw came from the way Elements constructed Rangeproof verification cache keys by concatenating multiple variable-length fields without adding length prefixes. That allowed different parameter combinations to produce the same cache key. By crafting transactions to trigger a cache collision, the attacker caused nodes to hit a previously cached “verification passed” result, skipping both secp256k1_rangeproof_verify and the minimum amount check. SlowMist added that it has traced the Bitcoin-side fund flows and completed its analysis of the incident.

Lookonchain said an address opened a 40x leveraged long position on 911.55 BTC around 10 hours ago, with the position valued at about $70.08 million. The monitored address has a liquidation price of $76,308.6, based on the data shared by the on-chain tracker. Lookonchain also said the same address has recently made 80 BTC trades and posted a 92.5% win rate. The disclosure points to a highly active trading record tied to the wallet, though no further identity details were provided in the source post. The update was published through Lookonchain’s X account.

A whale’s Bitcoin long position worth about $70 million is now sitting just $400 away from its liquidation price, according to monitoring shared by Ember. The position was opened last night at $77,733, with the whale going long 911.5 BTC. The liquidation level for the trade stands at $76,308. The update points to a highly leveraged BTC bet that has moved close to its risk threshold. No other details about the trader’s identity or platform were disclosed in the source. The report was cited by BlockBeats on Sept. 11.

Alex Thorn, head of firmwide research at Galaxy Digital, said Liquid’s approved-address restriction did not prevent the Sept. 6 attackers from moving bitcoin off the sidechain. According to CertiK, the incident began when a software flaw let an attacker create about 3,998.5 L-BTC that had no bitcoin backing, then convert those tokens into real BTC through Liquid’s own withdrawal process. Unchained reported that the withdrawals drained about 95% of the bitcoin pegged into Liquid before the sidechain was frozen the same day. Liquid’s developer documentation says peg-outs require a Peg-out Authorization Key, or PAK, and states that only users with registered PAK entries can withdraw to Bitcoin. Thorn said on Unchained’s Uneasy Money podcast that the restriction did not actually bind the attackers because ordinary users often rely on intermediaries such as federation members or exchanges. He pointed to a workflow described in Liquid’s documentation and said SideSwap would accept a destination address and auto-forward withdrawn BTC to that address. CertiK attributed the exploit to ambiguous cache-key encoding in the rangeproof verification cache. Liquid and SideSwap both said the withdrawal system itself remained intact, and Liquid said no key, including SideSwap’s, had been compromised. The attackers have since returned 3,400 BTC and kept 598.5 BTC.

An anonymous whale address increased its Bitcoin short on Hyperliquid after the latest U.S. Producer Price Index, or PPI, data was released, according to monitoring from TradingBeats cited by BlockBeats on Sept. 10. The address, 0xe2...3c8c, added roughly 116.8 BTC to the position in batches between 20:39 and 20:54, with the fills valued at about $9 million based on execution prices. That lifted the wallet’s BTC short from about 623.5 BTC to about 740.3 BTC, making it the second-largest BTC short on Hyperliquid. At the time of publication, the address was holding a 20x short position of about 740.28 BTC with a notional value of roughly $56.92 million. The average entry price was about $78,475, and the position was showing an unrealized profit of around $1.1765 million. The same address also ranked as the second-largest PONS short on Hyperliquid. It was holding a 3x short on about 8.6701 million PONS, with a position value of about $4.95 million, an average entry price near $0.8101, and an unrealized profit of roughly $2.071 million.

The Osmosis community has introduced a proposal aimed at restoring the peg of Alloyed BTC (allBTC) after a shortfall tied to unbacked nBTC minted through the Nomic bridge. Under the plan, the community would approve a future software upgrade to seize stolen assets frozen in attacker-controlled addresses and use BTC and allBTC held in the Osmosis community pool to cover the remaining gap. According to the proposal, the Nomic cross-chain bridge minted 40.65 nBTC on Osmosis on June 25, 2026, without Bitcoin backing. The issue remained hidden for 74 days and came to light when Nomic paused on Sept. 7. The incident left a total deficit of 39.84 BTC. Of that amount, about 22.65 BTC worth of assets was frozen in attacker addresses through emergency upgrade v31.1.0, while the remaining roughly 18 BTC was laundered through Tornado Cash and cannot be directly recovered. The proposal lays out four steps: intercepting USDC.noble-to-allUSDC conversion liquidity to free up an estimated 7.75 BTC from the community pool, allocating about 12.48 allBTC from the pool to the liquidity subDAO, transferring the frozen 22.65 allBTC to that subDAO, and marking nBTC as impaired in the allBTC converter before withdrawing and burning it. Deposits and withdrawals for allBTC on Osmosis would resume after the balance reaches zero and nBTC is removed from the basket.

A whale accumulated 767.8 BTC through THORChain over the past two days, according to monitoring data cited by BlockBeats. On Sept. 10 alone, the address kept buying through the cross-chain protocol, adding 544.5 BTC worth about $42.43 million. In total, the whale swapped 60.37 million USDC for the 767.8 BTC position across the two-day period. The average entry price was about $78,628 per BTC. The report cited EmberCN as the source of the on-chain tracking data and did not disclose the identity of the whale.