BounceBit Chain Releases Update on Vulnerability Attack Progress: Will Permanently Halt the Chain and Migrate to BNB Chain

Cross-chain yield protocol BounceBit has released a security incident notice, stating its blockchain network suffered a protocol-level vulnerability attack from 21:02 UTC on August 19 to 01:54 UTC on August 20. Attackers exploited an authorization flaw in Evmos’ underlying architecture to transfer BB tokens from 9 mainnet accounts without account owners’ authorization. Per the notice, the attackers moved approximately 286.5 million BB via 14 transactions. The incident is limited to BounceBit Chain itself, with no involvement of private key leaks, signature forgery, wallet, hardware device, or exchange account security issues. BounceBit’s CeDeFi Strategy, Promo Vaults, Prime, and RWA products were all unaffected. BounceBit noted the vulnerability stemmed from an authorization validation flaw in Evmos’ protocol-native module. When the attacker called the relevant module via a smart contract, they bypassed the security check that should verify the fund source account’s authorization, allowing them to designate any account as the fund source. After the incident, BounceBit Chain stopped block production at block height 20,702,857. The team decided not to perform a chain upgrade, instead permanently shutting down BounceBit Chain and reissuing BB as a BNB Chain-based BEP-20 token. The new BB supply will be based on an on-chain snapshot taken before the first abnormal transfer (block height 20,697,260). The 286,543,148 BB tokens transferred by attackers will not be included in new balances. Users do not need to submit applications or migrate wallets; the official will automatically distribute new BB to corresponding BNB Chain addresses.