BounceBit Chain Hacked: 2.9 Billion Tokens Transferred, Chain to Permanently Shut Down

The BounceBit Chain was hit by a protocol-level vulnerability attack between August 19th at 21:02 UTC and August 20th at 01:54 UTC, allowing hackers to transfer approximately 2.865 billion BB tokens from nine mainnet accounts without the owners' authorization.

The attackers exploited an authorization flaw in the Evmos underlying architecture's protocol native modules, bypassing security checks that should have verified the source account's authorization relationship.

BounceBit Chain has stopped producing blocks at block height 20,702,857 and will permanently shut down, with the team deciding not to perform a chain upgrade. BB tokens will be reissued as a BEP-20 token on the BNB Chain, with the new supply based on the pre-attack snapshot (block height 20,697,260).

The affected users do not need to apply for or migrate their wallets; the official plan is to automatically distribute the new BB tokens to corresponding BNB Chain addresses. Users who had staked BB will have it restored at the snapshot timepoint without needing to perform any unstaking or redemption actions.