When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
Smart contracts are published on the blockchains themselves and are open-source by definition. This means anyone can find a bug, and Symbiosis' thief found two: an undisclosed privilege escalation exploit that let them fake network administrator privileges, plus a Coding-101 failure of not checking if a transaction fee was a positive number.
The method was simple: being an admin, the thief set the transaction fee to a negative value, then issued 12 transactions. With the transaction fee now negative, instead of deducting from the moved amount, it added to it. The thief only spent 330 satoshi (the smallest unit of BTC), about 25 cents, but he managed to issue 46 billion syBTC — BTC wrapped in Symbiosis' network. For reference, the maximum theoretical amount of BTC in circulation is 21 million.
These syBTC tokens meant nothing by themselves as they weren't backed, but they were tradable. And trade the thief did, selling syBTC against matching wrapped pairs including BTCB, cbBTC, WBTC, and RBTC, draining those pools, and causing $770,000 worth of BTC in damage. It's known that they only converted about $336,000 into cash via Uniswap before being cut off.
The rest of the wrapped BTC tokens were flagged by security firms and exchanges, making it difficult for the thief to use. That's of little comfort for the victims, though, until such time as the thief returns the tokens by themselves or by law. Some of them, like Coinbase's cbBTC, are issued by centralized entities and can be nullified and re-minted after a legal process, but others like RBTC cannot.
Hackers drain $320 million in Bitcoin from Liquid Network, emptying roughly 95% of federation wallet
Anthropic's Claude hacked three real-life companies during security capabilities test
Poland lost $230 million in cryptocurrency trying to buy Venezuelan oil in 2023
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cryptocurrency/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cryptocurrency/hacker-turns-25-cents-into-46-billion-fake-bitcoins-to-steal-usd770-000-symbiosis-defi-exchange-bit-by-lack-of-basic-bounds-checking-in-smart-contract#main
- https://www.tomshardware.com/membership
- AI enthusiast builds GPT-6 Astra-powered bot to take on Balatro's Gold Stake Black Deck — bot leverages Python for numerical tools, beats hardest difficulty rep
- Grab a $560 saving on this 1440p-ready gaming PC with a 9800X3D and RTX 5060 Ti 16GB, now $1,859 — all-white CyberPowerPC desktop ships with one of AMD's best X
- ASML snubs Elon Musk-backed particle accelerator chipmaking tech — firm doubles down on 1,000W laser-produced plasma systems for chipmaking tools
- Pick up a giant 18-inch RTX 5080-powered Asus gaming laptop from Best Buy and save $600 — the ROG Strix G18 also comes with 32GB of memory and a 2TB SSD
- Skild AI Taps NVIDIA Physical AI to Teach Robots New Tasks From a Single Video
Informational only. No financial advice. Do your own research.