BounceBit to Permanently Shut Down BounceBit Chain After Protocol-Level Exploit, Reissue BB on BNB Chain

BounceBit has disclosed a security incident affecting BounceBit Chain, saying its network was exploited via a protocol-level vulnerability between Aug. 19, 21:02 UTC and Aug. 20, 01:54 UTC. According to the team, the attacker leveraged an authorization flaw in the Evmos-based architecture to move BB tokens from nine mainnet accounts without the owners' consent. The incident involved roughly 286.5 million BB transferred in 14 transactions. BounceBit said the impact was confined to BounceBit Chain. It reported no private key compromise, no signature forgery, and no breaches involving wallets, hardware devices, or exchange account security. The company added that its CeDeFi Strategy, Promo Vaults, Prime, and RWA products were not affected. The project attributed the root cause to a weakness in authorization verification within a native protocol module in the Evmos architecture. When the module was invoked through a smart contract, the attacker was able to bypass the control that should validate the authorization relationship of the source account, allowing any account to be designated as the funding source. Following the attack, BounceBit Chain stopped producing blocks at height 20,702,857. The team said it will not pursue a chain upgrade and has decided to permanently shut down BounceBit Chain, reissuing BB as a BEP20 token on BNB Chain. The new BB supply will be determined by an on-chain snapshot taken before the first abnormal transfer, at block height 20,697,260. BounceBit said the 286,543,148 BB allegedly stolen will be excluded from new token balances. Users will not need to file applications or migrate wallets. The official plan is to automatically airdrop the new BB to the corresponding BNB Chain addresses. For staked BB, BounceBit said balances will be restored based on the snapshot, and holders do not need to unbond or redeem. BounceBit added it has asked relevant exchanges to freeze assets and assist with the investigation. The team also warned users to be alert to scams and to avoid clicking any unverified links related to BB migration or token claims. The new BEP20 BB contract address and reissuance progress will be announced later.