BounceBit Shuts Down Blockchain After $3.2 Million Token Heist

The BounceBit blockchain will permanently shut down after an attacker moved 286.5 million BB tokens out of nine mainnet accounts, compromising a protocol-level authorization vulnerability.

The unauthorized transfers came from a flaw in the vesting and lockup account module, which allows smart contracts to call protocol-native modules directly.

BounceBit Chain ran on the Evmos stack, but due to the security incident, the project will reissue the token as a BEP-20 asset on BNB Chain instead of restarting its chain.

The attacker compromised no private keys, wallets, or hardware devices and made 14 transactions over 4 hours and 52 minutes using two accounts and 15 single-use contracts.