BounceBit Retires Its Chain After Attacker Moves 286.5 Million Tokens

BounceBit will permanently shut down its Layer 1 blockchain after an attacker moved 286.5 million BB out of nine mainnet accounts. The project will reissue the token as a BEP-20 asset on BNB Chain.

The team said the attacker compromised no private keys, wallets, or hardware devices. The unauthorized transfers came from a protocol-level authorization vulnerability.

Why BounceBit Will Not Restart Its Chain

BounceBit Chain ran on the Evmos stack, which lets smart contracts call protocol-native modules directly. One of those modules handles vesting and lockup accounts.

A funder account should be debited only after it authorizes the transfer. Along the smart-contract path, that binding was bypassed, and a second permission check ran against the wrong account. The attacker could therefore designate any account as the funding source without the holder’s consent.

The attacker ran 14 transactions over 4 hours and 52 minutes on 19 and 20 August, using two accounts and 15 single-use contracts. Block production stopped at height 20,702,857, roughly 42 minutes after the final transfer.

Meanwhile, Evmos itself has been discontinued. BounceBit said moving its fork to a successor codebase would demand a full rebuild, re-audit, and revalidation rather than a routine upgrade.

“Importantly, BounceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products are not affected,” the post read.

The exploit follows a security incident at MANTRA, which froze its network this week due to a vulnerability in an upstream dependency.

Follow us on X to get the latest news as it happens

What the Snapshot Means for BB Holders

The team will set the balances from block 20,697,260. None of the BB tokens that moved during the incident exist on the reissued token.

BB transfers made during the 5-hour-34-minute window will be reversed. Buyers will have those purchases undone, while sellers will receive the BB they sent back. Staked and unbonding balances count toward the snapshot.

BounceBit plans to credit reissued altcoins automatically to matching BNB Chain addresses. There is no claim site.

“We know this is disruptive, nothing is expiring and nothing is being rushed,” the team said.

BB traded near $0.0111 on Saturday, up 16% over 24 hours, per BeInCrypto Markets data. The token hit a record low of $0.0079 on August 20, about 31% below its level before the attack.

That leaves BB roughly where it started the week. The stolen supply amounts to about 13.6% of the 2.1 billion maximum, worth nearly $3.2 million at current prices.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights