BounceBit Shuts Down Layer‑1 Chain After Exploit Moves 286.5 Million BB Tokens

BounceBit announced the permanent closure of its Evmos‑based Layer 1 blockchain after a protocol‑level authorization vulnerability allowed an attacker to transfer 286.5 million BB tokens from nine mainnet accounts.

Cause of the exploit

The chain ran on the Evmos stack, which permits smart contracts to call native modules directly. A vesting and lockup module, intended to debit a funder account only after explicit authorization, was bypassed. A second permission check referenced the wrong account, enabling the attacker to designate any account as the funding source without the holder’s consent.

Attack timeline

The attacker executed 14 transactions over 4 hours 52 minutes on 19 – 20 August, using two accounts and 15 single‑use contracts. Block production stopped at height 20,702,857, roughly 42 minutes after the final transfer.

Response and token migration

BounceBit will reissue BB as a BEP‑20 token on BNB Chain. Balances will be snapshot at block 20,697,260; transfers made during the 5‑hour‑34‑minute window will be reversed, with buyers having purchases undone and sellers receiving the BB they sent back. Staked and unbonding balances are included in the snapshot, and the reissued tokens will be credited automatically to matching BNB Chain addresses. No claim site is required.

Impact on other products

The team clarified that its CeDeFi strategy, Promo Vaults, Prime, and RWA products are not affected by the shutdown.

Market reaction

BB traded near $0.0111, up 16 % over 24 hours, after falling to a record low of $0.0079 on August 20—a drop of about 31 % from pre‑attack levels. The stolen supply represents roughly 13.6 % of the 2.1 billion maximum supply, valued at approximately $3.2 million at current prices.