Cross-chain protocol Symbiosis has recovered 15 bitcoin following an exploit that targeted its Bitcoin bridge, according to statements from the project. The company disclosed the partial recovery as it continues to pursue the remaining stolen funds and has publicly offered the attacker a 20% bug bounty in exchange for returning the rest.

The recovery covers a portion of the assets drained in the incident. Symbiosis did not immediately disclose the full amount taken in the exploit or the precise technical mechanism the attacker used, leaving open the question of how much of the total haul the 15 BTC represents. The offer of a fifth of the stolen funds as a bounty follows a playbook that has become increasingly common in decentralized finance, where protocols negotiate directly with anonymous exploiters rather than relying solely on law enforcement.

Under such arrangements, the attacker returns the bulk of the assets — typically through a designated wallet address — and the protocol waives legal action and public identification efforts in exchange for a negotiated cut. The approach has produced mixed results across the industry, but it reflects the practical reality that on-chain thieves are often difficult to trace and harder still to prosecute across jurisdictions.

Symbiosis operates as a cross-chain liquidity protocol, allowing users to swap assets across multiple blockchains. Bridges — the infrastructure that moves assets between networks with different consensus mechanisms, such as Ethereum-style chains and Bitcoin — have repeatedly proven to be among the most attacked corners of the crypto market. Bridge exploits have accounted for several of the largest thefts in the industry's history, and the Symbiosis incident adds to a long pattern in which the bridge contract, rather than the underlying chains, becomes the point of failure.

The operational consequences for Symbiosis extend beyond the stolen bitcoin itself. Each bridge incident tends to depress user confidence in the affected protocol, and recovery of even part of the funds rarely restores the volume that flows through cross-chain infrastructure. Users weigh custodial and smart-contract risk each time they move assets across networks, and a public exploit forces a protocol to demonstrate both that it has patched the vulnerability and that its remaining infrastructure has been audited against similar attack vectors.

The 20% bounty offer signals that Symbiosis has not ruled out a negotiated settlement. That figure sits within the range typically offered in comparable cases, where protocols have proposed anywhere from 10% to as much as half of the stolen assets depending on how much leverage they believe they hold — including the possibility of tracing the attacker through chain analytics firms or freezing funds at exchanges if the thief attempts to cash out through regulated venues.

For now, the recovered 15 BTC is in the project's control, according to its own account. The fate of any remaining funds depends on whether the attacker responds to the bounty offer, and protocols in similar situations have typically set informal deadlines before pursuing other avenues, including public identification campaigns and law enforcement referrals.

The coming weeks will show whether the attacker accepts the terms or Symbiosis escalates to forensic tracing and legal action to claw back the remainder.