BounceBit Retires Layer 1 Chain After Attacker Moves 286.5M BB Tokens

BounceBit, the Bitcoin-focused CeDeFi protocol, has permanently retired its Layer 1 blockchain after an attacker drained 286.5 million BB from nine mainnet accounts. The team's official post-mortem confirmed that the attacker did not obtain any private keys, wallets, or physical devices, and that the unauthorized transfers stemmed from a protocol-level authorization flaw. BounceBit Chain, a Layer 1 appchain built on the Evmos stack, allowed smart contracts to call native protocol modules directly, including the module governing vesting and lockup accounts. Along the smart-contract path, the binding that requires a funder account to authorize a transfer was bypassed, and a second authorization check was evaluated against the wrong account. That flaw let the attacker designate any account as a funding source without the holder's consent. The attacker carried out 14 transactions over a window of 4 hours and 52 minutes on August 19-20, with two accounts and 15 single-use contracts. Block production came to a halt at height 20,702,857, about 42 minutes after the last transfer. Rather than attempt a routine upgrade, BounceBit said restoring the chain would require a complete rebuild, re-audit, and revalidation, especially since Evmos itself has been discontinued. BounceBit's CeDeFi Strategy, Promo Vaults, Prime, and RWA products were unaffected, and the token will be reissued as a BEP-20 asset on BNB Chain. The breach echoes a security incident at MANTRA, which froze its network earlier this week after a flaw was found in an upstream dependency.

BounceBit has outlined a snapshot-based recovery for BB holders, fixing balances from block 20,697,260, timestamped August 19, 2026 at 21:02:35 UTC. The team selected that block because it represents the last confirmed state before any unauthorized activity. Every BB token transferred during the incident is excluded from the reissued BEP-20 supply. Transactions executed within the 5-hour-34-minute attack window are being reversed: purchasers will see those buys canceled, and sellers will get the BB they sent back. Staked and unbonding balances count toward the snapshot, meaning users who had locked their tokens before the exploit remain covered. The project will credit the reissued altcoins automatically to matching BNB Chain addresses, with no claim site — a deliberate contrast to the standard airdrop flow in which users must visit a portal to collect tokens. The team acknowledged the disruption and said that nothing is expiring or being rushed. Market data shows BB trading near $0.0111, up 16% in 24 hours, after the token set a record low of $0.0079 on August 20, roughly 31% below its pre-attack level. That leaves BB about where it started the week. The stolen supply amounts to roughly 13.6% of the 2.1 billion maximum token supply, worth approximately $3.2 million at current prices. The team has not specified a completion date for the BEP-20 migration.

BounceBit's decision to retire the chain rather than patch it reflects the state of the underlying technology. The Evmos stack on which BounceBit Chain was built has itself been discontinued, and the exploited vulnerability was inherent to that framework; the team concluded that moving the fork to a successor codebase would require a full rebuild, re-audit, and revalidation rather than a routine upgrade. The project's core products — CeDeFi Strategy, Promo Vaults, Prime, and RWA — were unaffected, and most are already available on BNB Chain, where user activity had been concentrating. Consolidating on BNB Chain gives BounceBit access to a more mature security ecosystem, thicker liquidity, broader wallet and application support, and a far larger user and developer base. BEP-20 is the token standard used across BNB Chain, which streamlines wallet, exchange, and DeFi application support. BounceBit, which raised $6 million in a February 2024 seed round led by Blockchain Capital and Breyer Capital, describes its model as CeDeFi — pairing centralized asset-management safeguards with smart-contract efficiency. Its offerings include yield generation on Bitcoin deposits, BB-denominated derivative trading, and tokenized real-world assets such as U.S. Treasuries and gold; last year, Franklin Templeton's tokenized money-market fund was integrated into BB Prime as underlying collateral. The team has contacted the nine affected accounts and warned holders to beware of phishing attempts, stating that the snapshot will restore those accounts to the state they held immediately before the first unauthorized transaction, and that no action is required from users.

The common thread is trust recovery after a breach: publish the root cause, fix balances at a verifiable snapshot, and redeploy cleanly. On-chain data confirms the scale: 286.5 million BB drained through 14 transactions from nine accounts. The official post-mortem traces the exploit to an authorization-check bypass in the Evmos module handling vesting accounts, placing the flaw in the chain's internal logic rather than in user-held keys; no blind signing or user approval was needed. The remediation — permanent chain retirement and a reissued BEP-20 supply that excludes every stolen token — is unambiguous. What the post-mortem does not address is attacker identification or fund tracing. As of this writing, BB's spot price is down 6.9% over the last 24 hours.