Symbiosis said two software flaws in its Bitcoin Bridge let an attacker use a 330-satoshi bitcoin deposit, worth about $0.25, to generate roughly 46.1 billion unbacked syBTC through 12 bogus deposits. According to the project’s post-mortem and blockchain data reviewed by CoinDesk, the attack unfolded across BNB Chain, Ethereum and Rootstock in about four minutes. One bug let the attacker obtain administrator privileges by exploiting how the bridge identified the sender of a bitcoin transaction. A second bug treated a negative fee as an addition, allowing the deposit amount to be inflated to essentially any number the attacker entered. Despite the huge token count, Symbiosis put preliminary losses at 9.97 BTC, or about $770,000, because unbacked bridge tokens do not create the real assets needed for redemption. The project said syBTC supply had been only 13.91 before the attack, with 11.26 syBTC in pools paired with WBTC, cbBTC, BTCB and RBTC. Symbiosis has taken the native Bitcoin Bridge offline, said it will rewrite the bitcoin-side software, commission an independent audit and compensate affected users and liquidity providers.

Global markets are heading into a packed week that could shape both macro sentiment and crypto policy. The U.S. Federal Reserve is set to release its rate decision and economic projections early Thursday Beijing time, followed by remarks from Chair Warsh, while the Bank of England and the Bank of Japan are also due to announce policy decisions later in the week. In Washington, the U.S. Senate is preparing for a key procedural vote on the CLARITY Act on Tuesday, the same day the Securities and Exchange Commission plans to hold a roundtable on 24-hour trading. Around that backdrop, market participants are weighing fresh comments from Robinhood CEO Vlad Tenev, who argued that issuers should not have veto power over tokenized stock products if those instruments do not alter shareholder rights, issuer obligations, or the company’s official share register. Other developments include the EU’s Cyber Resilience Act taking effect, new product launches from Kraken and Grayscale, financing updates from Kaiko, Temporal and tZERO, continued inflows into spot Ether ETFs, and a newly disclosed exploit affecting Symbiosis’ Bitcoin bridge.

Blockaid said a flaw in the Bitcoin bridge used by cross-chain protocol Symbiosis allowed an attacker to mint roughly 2^62 syBTC to a newly created externally owned account. Using an 8-decimal calculation, the notional face value of the minted amount was about $46.1 billion. The attacker then sold about 4.39 WBTC on Uniswap V4 on Ethereum, realizing about $336,000. Symbiosis said the attack took place at around 04:28 on Sept. 11. The team has paused BTC routing, while other routes remain operational and were not affected. It also said it recovered about 15 BTC and moved the funds into a team-controlled multisig wallet. At the same time, the protocol offered the attacker a white-hat bounty equal to 20% of the funds involved, with a deadline of Sept. 13. The report added that Liquid Network, Nomic and Symbiosis have all seen recent security incidents involving the minting of tokens without real asset backing to expand supply. As of Sept. 13, Symbiosis had not published a technical postmortem for BridgeV2, the final loss amount, or confirmation on whether the attacker accepted the bounty.

Blockaid said it found a vulnerability in the bitcoin bridge of cross-chain protocol Symbiosis, where an attacker minted about 2^62 syBTC to a newly created externally owned account. Using an 8-decimal calculation, the face value was roughly $46.1 billion. The attacker then sold about 4.39 WBTC on Uniswap V4 on Ethereum, cashing out around $336,000. Symbiosis said the attack took place at about 4:28 on Sept. 11. The team has suspended the BTC route, while other routes remain operational and were not affected. It also said it recovered about 15 BTC and moved the funds into a team-controlled multisig wallet. The protocol is offering the attacker a white-hat bounty equal to 20% of the funds, with a deadline of Sept. 13. As of Sept. 13, Symbiosis had not published a BridgeV2 technical post-mortem, the final loss amount, or confirmation on whether the attacker accepted the bounty. The incident came during a period in which Liquid Network, Nomic and Symbiosis each saw security events involving supply expansion through minting tokens without real asset backing.

Blockaid said it detected an attack involving cross-chain protocol Symbiosis on BNB Smart Chain, or BSC. According to the security firm, a transaction signed by BridgeV2 moved about 2^62 raw syBTC into a newly created externally owned account, or EOA. Blockaid said the token used 8 decimals and carried a face value of about 46.1 billion. The same beneficiary then sold roughly 4.39 WBTC on Ethereum’s Uni V4, the firm said. As of the latest update cited in the post, the attacker had already converted about $336,000 worth of WBTC into cash. The information was attributed to Blockaid’s on-chain monitoring and was published through its X account. No additional details on the exploit method or wider impact were provided in the source material.