BounceBit has announced plans to permanently shut down its Layer 1 blockchain after an attacker transferred 286.5 million BB tokens out of nine mainnet accounts. The project will reissue the token as a BEP-20 asset on the BNB Chain.
According to the project team, no private keys, wallets, or hardware devices were compromised during the incident. Instead, the unauthorized transfers stemmed from a protocol-level authorization vulnerability.
Details of the Exploit
The BounceBit Chain operated on the Evmos stack, which allows smart contracts to directly call protocol-native modules, including one that manages vesting and lockup accounts. Normally, a funder account should only be debited after authorizing a transfer. However, along the smart-contract path, this binding was bypassed, allowing a second permission check to run against the incorrect account. This enabled the attacker to designate any account as a funding source without the holder's consent.
The attacker executed 14 transactions over a period of 4 hours and 52 minutes on August 19 and 20, utilizing two accounts and 15 single-use contracts. Block production was halted at height 20,702,857, approximately 42 minutes after the final unauthorized transfer.
BounceBit noted that Evmos itself has been discontinued, meaning that moving its fork to a successor codebase would require a complete rebuild, re-audit, and revalidation rather than a standard upgrade. The team confirmed that the BounceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products remain unaffected.
Token Reissue and Snapshot
To address the incident, the team will establish token balances based on a snapshot taken at block 20,697,260. BB tokens that moved during the incident will not exist on the reissued token.
Transfers made during the affected window will be reversed. Purchases made during this time will be undone, and sellers will receive their sent BB back. Staked and unbonding balances are included in the snapshot.
BounceBit plans to automatically credit the reissued tokens to matching BNB Chain addresses without requiring a claim site.
Market Impact
The stolen supply accounts for roughly 13.6% of the 2.1 billion maximum token supply, valued at nearly $3.2 million at current prices. The token previously hit a record low of $0.0079 on August 20, representing about a 31% drop from its pre-attack level, before trading near $0.0111 on Saturday.
