BounceBit Shuts Down Layer 1 After $286M Authorization Exploit

BounceBit's Layer 1 blockchain has been shut down indefinitely due to an authorization exploit that allowed an attacker to transfer over 286 million BB. The incident occurred on August 19-20, with the attacker moving funds from nine mainnet accounts in just four hours.

The issue was identified as a protocol-level problem related to Evmos' lockup and vesting account functionality, which was meant to verify the funder's permission but failed to do so. This enabled the attacker to set an arbitrary account as the funding source.

BounceBit emphasized that no private keys, signatures, wallets, or exchange accounts were breached in the incident, which was solely due to a protocol failure. The company has chosen not to rebuild the network and instead will reissue BB as a BEP-20 token on BNB Chain, using a pre-incident snapshot to calculate new balances.

The project has ceased block production at block 20,702,857 and submitted requests for assistance and freezing to exchanges. The reissued token will have no tokens carried over from the incident, with all BB issued during that time period being returned to counterparties or senders.