A hacker turned 25 cents of bitcoin into 46 billion fake BTC tokens on a DeFi bridge
Two software bugs allowed the attacker to create more than 2,000 times Bitcoin’s maximum supply in unbacked syBTC. Symbiosis puts preliminary losses at 9.97 BTC.
Printing 46 billion fake bitcoin BTC$76,250.30-linked tokens on cross-chain application Symbiosis started with a deposit of just 330 satoshi, the smallest unit of bitcoin, worth about 25 cents in total.
The service lets users swap tokens across blockchains where they may not originally be supported. A post-mortem published early Tuesday shows how two software flaws in the Symbiosis’ Bitcoin Bridge combined to let an attacker create enormous amounts of syBTC, a token meant to represent bitcoin held by the system.
Blockchain data reviewed by CoinDesk shows the attacker processed 12 bogus deposits across BNB Chain, Ethereum and Rootstock in roughly four minutes, eventually creating about 46.1 billion syBTC, or more than 2,000 times Bitcoin's 21 million coin limit.
The discrepancy between the number of tokens created and the actual loss stems from a feature of the process. Coining unbacked bridge tokens does not make the real assets needed to redeem them. The attacker could extract value only from whatever actual bitcoin-linked liquidity was sitting on the other side.