The Hacker Who Created 46 Billion Bitcoin From Nothing

SPEAKER_1 (0:00)

Welcome back to the Daily Crypto Deep Dive. Bitcoin has one rule that almost everybody in crypto knows. There will never be more than 21 million Bitcoin. It is arguably the single most important number in the entire cryptocurrency industry.

Governments can print currencies. Companies can issue shares. Central banks can expand their balance sheets. But Bitcoin's supply is written into the protocol. 21 million. That is it.

Except this week, somebody managed to create more than 46 billion of them.

Not real Bitcoin, but something that, under the right circumstances, was supposed to represent Bitcoin one for one. And for a brief period, one crypto wallet appeared to contain more than 2,000 times the entire amount of Bitcoin that will ever exist. This is the extraordinary story of the Symbiosis Bitcoin Bridge exploit, a vulnerability that allowed an attacker to manufacture an almost incomprehensible quantity of synthetic Bitcoin from nothing, before attempting to turn some of those fake coins into assets that were very real. And while the amount actually converted appears relatively small by modern crypto hack standards, this might be one of the best demonstrations we have seen of an uncomfortable truth about Bitcoin.

Bitcoin itself can be incredibly difficult to attack. But the machinery we build around Bitcoin can be a completely different story.

The attack happened on September 11th. Symbiosis is what is known as a cross-chain protocol. Its job, essentially, is to help assets move between blockchains that ordinarily cannot communicate with each other. That matters particularly for Bitcoin. Bitcoin does not natively live on Ethereum. It does not live on BNB chain. And you cannot simply take a Bitcoin sitting on the Bitcoin blockchain, drag it across the internet and drop it into an Ethereum DeFi application. So crypto developers created representations of Bitcoin. Depending on the system, you deposit or lock the real asset somewhere and another blockchain creates a token representing the value you deposited. Think of it like putting a gold bar into a vault and receiving a certificate saying that certificate represents one gold bar. Provided there really is one gold bar sitting in the vault, the certificate has value. But now imagine somebody discovers a machine in the back office capable of printing gold certificates. No gold has entered the vault. Nothing has been deposited. Yet the machine starts printing certificates anyway. That in simplified terms is what makes the Symbiosis incident so extraordinary.

Symbiosis uses a synthetic Bitcoin asset called SyBTC as part of its cross-chain infrastructure. Under normal conditions, the system is designed so these synthetic assets correspond with actual assets moving through the system. The protocol's own documentation describes a mint and burn process. Assets are locked on one side, corresponding synthetic assets can be minted on another, and when those synthetic assets are burned, the underlying assets can be released. The important principle is simple. You should not be able to create the receipt without the deposit. But according to security monitoring surrounding the attack, a transaction involving Symbiosis' Bridge 5-2 contract resulted in roughly 2 to the power of 62 raw units being transferred to a newly created wallet. That number is 4,611,686,018,427,387,904 raw units. But SYBTC uses 8 decimal places, just like Bitcoin. So convert those raw units into whole tokens, and you are left with approximately 46.1 billion SIBTC, 46 billion. For comparison, Bitcoin's absolute maximum supply is 21 million.

The attacker had therefore created a synthetic Bitcoin balance equivalent to more than 2,000 times the number of Bitcoin that can ever exist. If every one of those tokens had genuinely been exchangeable one for one for Bitcoin, we wouldn't be talking about a large crypto hack. We would be talking about something mathematically impossible to honor. At a Bitcoin price somewhere around the high $70,000 region, treating $46 billion SIBTC as if every token were genuinely backed would produce a theoretical value measured in quadrillions of dollars. More money than exists for any realistic purpose on earth. But that theoretical number is almost meaningless. And understanding why is the most important part of this story. Creating $46 billion tokens does not mean creating $46 billion Bitcoin. It does not even mean stealing $46 billion Bitcoin.

If I create a spreadsheet saying I own $1 trillion, I haven't become the richest person in history. The question is whether anybody will give me something valuable in exchange for the numbers on my spreadsheet. And that became the attacker's problem. The attacker had acquired an absurd quantity of BTC. But there wasn't an absurd quantity of genuine liquidity waiting to buy it. Instead, the attacker needed to find routes through the crypto ecosystem where the newly created synthetic asset could be exchanged for something real. Security researchers reported that the same beneficiary subsequently sold a portion of the illegitimate SIBTC and obtained approximately 4.39 wrapped Bitcoin through Uniswap on Ethereum. That was worth roughly $336,000 at the time. So stop and appreciate the ridiculous difference between those two numbers.