YZi Labs-backed BounceBit has announced plans to permanently cease its BounceBit Chain following a significant security breach. According to latest reports, the attacker exploited a flaw in one of BounceBit Chain's built-in protocol modules to move approximately 286.5 million BB tokens through 14 transactions over roughly five hours and 34 minutes from 19 and 20 August. The protocol failed to verify whether the debited account had authorized each transaction, allowing the attacker to name another account as the funding source and transfer BB without permission from account owners. Importantly, the team confirmed that no private keys, wallets, or hardware devices were compromised during the attack.
The vulnerability exposed deeper structural problems with BounceBit Chain's underlying technology. As reported by AMBCrypto, the network was built on the Evmos stack, which included a vesting and lockup module that has since been discontinued. The attacker bypassed a binding that should have prevented unauthorized transfers, with a second permission check running against the wrong account. This allowed the attacker to designate any account as the funding source without the holder's consent. Simply fixing the vulnerability and restarting the network would require a substantial re-platform involving a full rebuild, re-audit, and revalidation before safely carrying user assets again. BounceBit has determined that moving their fork to a successor codebase would be more than a conventional upgrade, necessitating a complete rebuild rather than a patchwork solution.
Instead of rebuilding its own Layer 1 infrastructure, BounceBit has decided to relocate BB as a BEP-20 token on BNB Chain. According to latest reports, the project already has many products operating on BNB Chain, where user activity is increasingly concentrated. This migration will provide BounceBit with mature security, deeper liquidity, and wallet support compared to maintaining their own independent blockchain. The company believes consolidating around BNB Chain is safer and more efficient than spending significant resources on rebuilding their own Layer 1 infrastructure. Importantly, BounceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products are not affected by this chain shutdown.
The team will set balances from block 20,697,260 and will reverse all BB transfers made during the 5-hour-34-minute window. Buyers will have purchases undone, while sellers will receive the BB they sent back. Staked and unbonding balances count toward the snapshot. BounceBit plans to credit reissued altcoins automatically to matching BNB Chain addresses with no claim site required. The stolen supply amounts to about 13.6% of the 2.1 billion maximum, worth nearly $3.2 million at current prices. BB traded near $0.0111 on Saturday, up 16% over 24 hours, though it hit a record low of $0.0079 on August 20, about 31% below its level before the attack.
