Symbiosis said it recovered approximately 15 BTC after an attacker exploited a vulnerability in its Bitcoin Bridge on September 11, 2026. The cross-chain protocol also offered the attacker a white-hat bounty equal to 20% of the funds. However, the recovery figure remains based on Symbiosis’ report, and the total losses and outcome of the bounty offer have not been established.

According to Symbiosis’ statement on X, the exploit occurred at approximately 04:28 UTC on September 11. The incident statement was published at 16:04:05 UTC the same day. Symbiosis said the recovered Bitcoin had been secured in a team-controlled multisig, although that claim has not been independently verified on-chain.

Symbiosis reports approximately 15 BTC recovered

The approximately 15 BTC recovery was presented as a partial figure rather than a final accounting. Symbiosis said its final accounting remained in progress and that confirmed figures would be provided in a later update. The protocol did not disclose total losses, remaining exposure, or the amount, if any, that remained unrecovered.

As a result, the recovered Bitcoin cannot be assessed as a proportion of total losses. No recovery transaction hash, receiving address, or blockchain explorer entry was included in the supplied material to independently confirm the movement of funds.

For users and liquidity providers assessing the incident, the distinction between a reported recovery and an independently verifiable recovery remains material. The final loss calculation, confirmation of the recovered funds, and clarification of which services can safely resume are separate points that had not been established in the available information.

Symbiosis said BTC routes had been halted and the Bitcoin Bridge isolated after the incident. It stated that its EVM, TRON, TON, and other routes, as well as Octopools, remained unaffected and were operating normally when the statement was issued.

The operational summary published by Symbiosis on X stated:

Symbiosis experienced a security incident. At approximately 04:28 UTC on Sep 11, 2026, attacker exploited a vulnerability in Bitcoin Bridge. BTC routes have been halted. Other routes remain operational and safe. Where we stand: • Only the Bitcoin Bridge was affected, and it is… — Symbiosis (@symbiosis_fi) September 11, 2026

The exploit mechanics, the complete list of affected users, and the bridge’s current operating status were not independently established in the supplied material.

Protocol offered a 20% white-hat bounty

Alongside its recovery report, Symbiosis said it offered the attacker a white-hat bounty worth 20% of the funds. The offer was open until September 13, 2026, but the protocol did not specify a deadline hour or time zone. It also did not state the base amount to which the 20% calculation would apply.

Symbiosis said that after the attacker’s offer window closed, the same percentage would be offered to anyone providing information that led to recovery. The available material does not show that the attacker accepted the offer or that a bounty payment was made.

The bounty proposal does not constitute a legal settlement. No regulatory filing, enforcement action, or immunity agreement related to the offer was verified. Accordingly, the offer cannot be treated as evidence that the incident had been resolved.

Compensation framework remains undeveloped

Symbiosis said it was contacting every affected liquidity provider directly and developing a compensation framework. The criteria for that framework had not been published.

Because the stated September 13 offer period had passed by September 14, the outcome remained unclear. The available information did not establish whether the incident was fully resolved, whether any bounty had been paid, or whether BTC routes had resumed.

Bitcoin traded at approximately $76,803 on September 14, down about 0.6% over 24 hours, according to a retrieval-date market snapshot. That price information does not establish that the bridge exploit affected Bitcoin’s market performance. Broader market developments, including expectations surrounding a September 16 Federal Reserve vote, were separate from the security incident.

Source: CoinWy.