BounceBit Shuts Down Layer 1 After $3M Token Exploit

BounceBit has permanently shut down its Layer 1 blockchain due to a critical authorization flaw that allowed an attacker to move around $3 million in BB tokens without permission. The exploit occurred between August 19 and 20, with 14 unauthorized transactions made between 21:02 UTC on August 19 and 01:54 UTC on August 20.

The issue centered on a native module inherited from the Evmos technology stack used by BounceBit Chain. A smart contract caller could specify another account as the source of funds without proper verification, making it a protocol-level authorization failure rather than a wallet compromise or stolen-key attack.

BounceBit initially considered patching and restarting the network but has instead chosen to retire the Layer 1. The team is moving forward with reissuing BB as a BEP-20 token on BNB Chain, using a snapshot taken at block 20,697,260 at 21:02:35 UTC on August 19.

The attacker's 286,543,148 BB will be excluded from the replacement issuance. Legitimate balances will be restored automatically to corresponding BNB Chain addresses, including BB held in staking and unbonding positions.