A BridgeV2 receive transaction on BSC minted approximately 2^62 raw units of syBTC to a fresh attacker-controlled EOA, creating an enormous quantity of unbacked syBTC. The same beneficiary subsequently used the unbacked syBTC against syBTC/WBTC liquidity on Ethereum Uniswap V4, extracting and selling approximately 4.39 WBTC. The exact flaw that caused BridgeV2 to accept or authorize the malicious receive has not yet been publicly established

An attacker exploited a vulnerability in Symbiosis’ Bitcoin Bridge (BridgeV2) by abusing incorrect parsing of Bitcoin transaction data and negative fee settings, minting approximately 2622^{62}2^{62} unbacked syBTC (notional face value ~46.1 billion) across BSC, Ethereum and Rootstock within about four minutes, then sold ~4.39 WBTC on Ethereum’s Uniswap V4 for ~$336,000. The team immediately paused native BTC routes, isolated the affected component, evacuated ~15.2 BTC of portal funds to reserve addresses, and offered a 20% white-hat bounty. The post-mortem confirmed total losses for LPs and affected users at 9.97 BTC. Other routes (EVM, TRON, TON, etc.) remained unaffected.