Cross-chain protocol Symbiosis mentioned it recovered roughly 15 BTC after an attacker exploited its native Bitcoin Bridge, however affected liquidity suppliers nonetheless lack compensation phrases as a Sep. 13 bounty window nears its unspecified cutoff.
The vulnerability was exploited at about 04:28 UTC on Sep. 11, in keeping with the protocol’s incident assertion. Symbiosis mentioned solely the Bitcoin Bridge was affected and that its different routes and elements remained operational. It particularly listed routes spanning EVM chains, TRON and TON as unaffected, and mentioned its relayer group continued working to safe the community. The protocol mentioned the recovered bitcoin is secured in a team-controlled multisig.
The 15 BTC determine is just the quantity Symbiosis says it recovered so far. The protocol mentioned last accounting remained in progress and that it will publish confirmed figures in one other replace.
Safety agency Blockaid reported {that a} transaction accepted as signed by Symbiosis’s BridgeV2 system minted roughly 2^62 uncooked models of syBTC, an artificial illustration of bitcoin, to a newly created pockets on BNB Chain.
Blockaid mentioned the identical beneficiary bought about 4.39 WBTC on Ethereum, realizing roughly $336,000 in WBTC proceeds on the time of its alert. That determine covers worth Blockaid noticed the attacker convert. It doesn’t set up Symbiosis’s last loss or the full publicity of liquidity suppliers.
Symbiosis initially mentioned Bitcoin-related swaps have been unavailable whereas it deployed updates. In a later operational replace, the protocol mentioned Bitcoin swaps routed via companions Chainflip and THORChain have been again on-line, whereas the native Symbiosis Bitcoin Bridge remained paused.
That distinction determines what customers can entry. Companion-routed Bitcoin swaps can be found, in keeping with Symbiosis, however the protocol has not introduced the return of the affected bridge. The cut up retains visitors off Symbiosis’s paused bridge whereas customers entry various Bitcoin routes.
Symbiosis mentioned it was contacting each affected liquidity supplier instantly and constructing a compensation framework, with standards to comply with. It has not disclosed who will qualify, how compensation will probably be calculated or when funds might start.
The protocol additionally provided the attacker a 20% white-hat bounty via Sep. 13. After that window, Symbiosis mentioned the identical share could be provided to anybody offering info that results in restoration. The assertion didn’t specify an actual cutoff time or timezone.
Affected liquidity suppliers are actually ready for 3 disclosures: confirmed loss and publicity figures, compensation standards, and any change to the native bridge’s standing. Till Symbiosis publishes that info, the recovered funds and Blockaid’s proceeds estimate shouldn’t be handled as a last loss tally.
