BounceBit is not patching its Layer 1 after a protocol exploit. It is retiring the chain entirely. On August 21, BounceBit said an attacker exploited an authorization flaw in the Evmos-based
BounceBit is not patching its Layer 1 after a protocol exploit. It is retiring the chain entirely.
On August 21, BounceBit said an attacker exploited an authorization flaw in the Evmos-based architecture underlying BounceBit Chain. The incident occurred between August 19 at 21:02 UTC and August 20 at 01:54 UTC.
The attacker moved approximately 286.5 million BB tokens from nine mainnet accounts across 14 transactions. BounceBit halted block production at height 20,702,857.
The team said no private keys were compromised, no signatures were forged, and no wallets, hardware devices, or exchange accounts were breached. It also said its CeDeFi Strategy, Promo Vaults, Prime, and real-world asset products were unaffected.
According to BounceBit, the vulnerability affected authorization verification in a native module inherited from the Evmos architecture.
When that module was called through a smart contract, an attacker could allegedly specify another account as the source of funds without proving that the account had authorized the transfer.
In plain English, the system checked that a transfer request existed but failed to verify that the named source account had actually approved it.
Instead of upgrading the network, BounceBit will permanently retire its standalone chain and reissue BB as a BEP-20 token on BNB Chain.
Balances will be reconstructed from a snapshot taken before the first unauthorized transfer, at block height 20,697,260. The 286,543,148 BB moved by the attacker will be excluded from the reissued supply.
BounceBit says users will not need to submit claims or manually migrate their wallets. New tokens are expected to be distributed automatically to corresponding BNB Chain addresses, while staked balances will be restored from the snapshot.
The new BEP-20 contract address has not yet been announced. Users should treat any migration or claim link circulating before an official announcement as suspicious.
The dollar value of the exploit—about $3 million—is not the main story. The more consequential fact is that a protocol-level authorization failure led a project to abandon its own Layer 1.
That decision removes BounceBit's independent execution environment and makes BNB Chain the settlement layer for BB. It may reduce the operational burden of maintaining a standalone network, but it also changes the project's architecture and dependencies.
BounceBit said rebuilding the Evmos-based chain would be difficult because Evmos was discontinued earlier in 2026 and because most BounceBit products and users were already accessible through BNB Chain.
Confirmed: BounceBit Chain has halted; approximately 286.5 million BB were transferred without authorization; the chain will be retired; BB will be reissued on BNB Chain using a pre-exploit snapshot.
Still uncertain: the attacker's identity, whether all exchange-held balances will be reconciled without losses, the final migration timeline, the new contract address, and whether independent reviewers will confirm the stated root cause.
The blockchain has spoken. This time, it delivered its own shutdown notice.
This article is for informational purposes only and does not constitute financial, investment, or legal advice.
