Cross-chain protocol Symbiosis stated it recovered roughly 15 BTC after an attacker exploited its native Bitcoin Bridge, however affected liquidity suppliers nonetheless lack compensation phrases as a Sep. 13 bounty window nears its unspecified cutoff.
The vulnerability was exploited at about 04:28 UTC on Sep. 11, in accordance with the protocol’s incident assertion. Symbiosis stated solely the Bitcoin Bridge was affected and that its different routes and elements remained operational. It particularly listed routes spanning EVM chains, TRON and TON as unaffected, and stated its relayer group continued working to safe the community. The protocol stated the recovered bitcoin is secured in a team-controlled multisig.
The 15 BTC determine is just the quantity Symbiosis says it recovered so far. The protocol stated remaining accounting remained in progress and that it could publish confirmed figures in one other replace.
Safety agency Blockaid reported {that a} transaction accepted as signed by Symbiosis’s BridgeV2 system minted roughly 2^62 uncooked items of syBTC, an artificial illustration of bitcoin, to a newly created pockets on BNB Chain.
Blockaid stated the identical beneficiary bought about 4.39 WBTC on Ethereum, realizing roughly $336,000 in WBTC proceeds on the time of its alert. That determine covers worth Blockaid noticed the attacker convert. It doesn’t set up Symbiosis’s remaining loss or the entire publicity of liquidity suppliers.
Symbiosis initially stated Bitcoin-related swaps had been unavailable whereas it deployed updates. In a later operational replace, the protocol stated Bitcoin swaps routed by companions Chainflip and THORChain had been again on-line, whereas the native Symbiosis Bitcoin Bridge remained paused.
That distinction determines what customers can entry. Accomplice-routed Bitcoin swaps can be found, in accordance with Symbiosis, however the protocol has not introduced the return of the affected bridge. The cut up retains visitors off Symbiosis’s paused bridge whereas customers entry various Bitcoin routes.
Symbiosis stated it was contacting each affected liquidity supplier immediately and constructing a compensation framework, with standards to comply with. It has not disclosed who will qualify, how compensation shall be calculated or when funds might start.
The protocol additionally provided the attacker a 20% white-hat bounty by Sep. 13. After that window, Symbiosis stated the identical share could be provided to anybody offering data that results in restoration. The assertion didn’t specify a precise cutoff time or timezone.
Affected liquidity suppliers at the moment are ready for 3 disclosures: confirmed loss and publicity figures, compensation standards, and any change to the native bridge’s standing. Till Symbiosis publishes that data, the recovered funds and Blockaid’s proceeds estimate shouldn’t be handled as a remaining loss tally.
