BounceBit will retire its chain after $3 million token exploit
The project says an authorization flaw moved 286.5 million BB from nine accounts without compromising private keys, and plans to reissue the token on BNB Chain from a pre-attack snapshot.
By The Third AnglePublished 3 min read
Illustrative computing hardware; it does not depict BounceBit's chain or the exploit. Photo: Unsplash · Unsplash License
BounceBit said it will permanently retire its standalone blockchain and move BB to BNB Chain after an authorization flaw allowed an attacker to transfer about 286.5 million tokens from nine accounts. The project's official announcement said the incident did not compromise private keys, signatures, wallets or exchange accounts.
The independent report from The Block said the tokens were worth roughly $3 million at the time. BounceBit attributed the flaw to an Evmos-stack feature that let a contract caller specify another account as the source of funds without proving authorization.
A chain migration, not a wallet recall
BounceBit said it will use a pre-attack snapshot to reissue BB as a BEP-20 token on BNB Chain and exclude the unauthorized transfers. It also said it is working with exchanges to correct customer balances so holders do not absorb losses caused by the exploit.
The project said its CeDeFi Strategy, Promo Vaults, Prime and real-world-asset products were unaffected. It warned that the chain's block production was halted after the transfers and that users should rely on official channels for migration information.
Why BounceBit chose to shut the network
Rather than patching the standalone Layer 1, BounceBit said rebuilding it would be difficult because Evmos was discontinued and most of its products and users already operate on BNB Chain. Its stated conclusion was that maintaining a standalone Layer 1 was no longer the most effective way to serve users.
The immediate operational question is when exchanges will restore deposits and withdrawals and how the snapshot-based reissue will be implemented. Until those details are published by the project or individual venues, BB holders should treat migration instructions from unofficial accounts as unverified.
