BounceBit Chain to Shut Down After $3.1M BB Token Hack

BounceBit said it has decided to permanently shut down BounceBit Chain after a hack that took place between Aug. 19 and 20, in which attackers moved roughly 286 million BB tokens valued at about $3.1 million from nine chain addresses. According to the team, the exploit stemmed from an authorization flaw in Evmos' vesting and account-locking module, the underlying network BounceBit Chain was built on. Some of the stolen tokens were routed to exchanges: about 254 million BB to an unnamed major platform, nearly 10 million BB to another exchange, while the remaining 18.5 million BB still sit at a single address. BounceBit said it has contacted the exchanges and requested freezes on specific addresses. The developers said they will not attempt to restore the network, citing the fact that Evmos infrastructure is no longer operational. They added that migrating the fork to a new codebase would effectively require rebuilding the platform and completing fresh audits and validation before assets could be transferred safely again. BB will be reissued as a BEP20 token on BNB Chain. Distribution will be based on a pre-attack snapshot at block 20,697,260, and the stolen 286.5 million BB will be excluded from the new issuance. The team said users do not need to take any action, as the replacement tokens will be automatically distributed to addresses on BNB Chain. Earlier, BounceBit said it had identified an issue affecting the chain and paused nodes as a precaution while deploying a fix, temporarily disabling BB transactions. The team said the incident was limited to the chain and did not affect the CeDeFi app, smart contracts, or vaults. BounceBit raised $6 million in 2024 from Blockchain Capital and Breyer Capital, and YZi Labs invested in the project in late April that year. The incident follows a string of recent crypto security breaches. Last week, Maya Protocol was compromised for $1.7 million in crypto assets, largely bitcoin. Previously, crypto service Coinsbuy was hit in an attack that resulted in $7.9 million being withdrawn.