BounceBit said it will shut down BounceBit Chain after an exploit drained more than $3.1 million worth of BB tokens from wallets tied to the network. The company linked the incident to an authorization weakness in a vesting and lockup account module based on Evmos infrastructure used by the chain.

According to BounceBit, attackers moved 286 million BB tokens out of nine BounceBit Chain wallets between August 19 and August 20. The firm initially paused nodes and disabled BB transactions while it investigated, saying the issue was limited to the chain and did not affect its CeDeFi app, smart contracts, or vaults.

How the exploit unfolded

BounceBit said the unauthorized transfers were made possible by a flaw in the authorization logic of the vesting and lockup module hosted by Evmos and used on BounceBit Chain. The company has not described the attacker’s identity, but it said the tokens were removed without authorization from nine wallets connected to the chain.

The firm estimated that about 254 million BB tokens were sent to one major crypto exchange, nearly 10 million BB tokens went to another exchange, and 18.5 million BB tokens remain in a consolidated address. Those figures account for most of the 286 million BB tokens that BounceBit said were moved during the exploit window.

Why BounceBit is ending the network

After a technical review, BounceBit said it decided to sunset BounceBit Chain rather than attempt to continue operating it. The company said it could not safely carry out a network upgrade because the blockchain is built on discontinued Evmos infrastructure.

In BounceBit’s account, moving its fork to a successor codebase would not amount to a normal software upgrade. Instead, it said the process would require a full rebuild, followed by a fresh audit and revalidation before the network could safely hold user assets again.

Plan to reissue BB on BNB Chain

BounceBit said all BB balances not linked to the attacker will be reissued as BEP-20 BB tokens on BNB Chain. The company plans to use a snapshot from the block immediately before the exploit to calculate how many replacement tokens each holder should receive.

The firm said token holders do not need to take any action. It also warned users to be careful of scammers who may offer fake assistance during the transition.

Exchange coordination and next steps

BounceBit said it has asked crypto exchanges to freeze specific addresses associated with the exploit, adding that the requested freezes would not affect funds belonging to innocent users. It did not say whether any exchange had already acted on that request.

The next confirmed step is the balance restoration process based on the pre-exploit snapshot, alongside the migration of non-attacker BB holdings to BNB Chain. BounceBit has already made clear that BounceBit Chain itself is being wound down rather than repaired in place.

Source: protos.com