Hackers Mint Trillions of Fake Bitcoin — ~15 BTC Recovered but Liquidity Providers Unpaid

The messy heist and the half-baked recovery

Late on Sep. 11, something went very wrong with a cross-chain Bitcoin bridge: an attacker managed to trick the bridge into minting an astronomically large amount of synthetic BTC. The protocol says the exploit happened around 04:28 UTC and only its native Bitcoin bridge was hit — other routes and services kept humming along.

So far the team has managed to grab back roughly 15 BTC and locked that stash in a team-controlled multisig. They’re still counting though, and they warn the final tallies remain a work in progress. Meanwhile a security vendor noted the attacker minted a huge quantity of synthetic BTC on one chain, moved some value into wrapped Bitcoin on Ethereum and sold a chunk — roughly 4.39 WBTC — realizing about $336,000 at that snapshot in time. That observed conversion is only part of the picture and not the protocol’s final loss number.

To keep things moving for users, swaps that route Bitcoin through partners were restored, but the protocol’s own native Bitcoin bridge is still paused. In plain terms: alternate routes are open, the original bridge is on time-out.

What users (and liquidity providers) are waiting for

Right now the affected liquidity providers are basically in limbo. The team says it’s reaching out to every impacted provider and working on a compensation plan, but hasn’t published who qualifies, how payouts will be calculated, or when cash might flow. Those are the three things everyone’s asking for: confirmed loss/exposure figures, the compensation criteria, and a timeline or status update on the native bridge.

There’s also a bounty angle: the protocol offered a 20% white-hat bounty through Sep. 13, and after that date the same percentage would be offered to anyone who provides information that helps recovery. The exact cutoff time and timezone were not specified, so it’s a little vague — and vague is never fun when money and hackers are involved.

Bottom line: the team pulled back a chunk of funds and rerouted users so the wider system didn’t totally collapse, but many questions remain unanswered. Liquidity providers are waiting on detailed accounting and a clear compensation roadmap before anyone can call this one closed.