Odaily Planet Daily News Cross-chain yield protocol BounceBit released a security incident announcement stating that its blockchain network experienced a protocol-level vulnerability attack between 21:02 UTC on August 19 and 01:54 UTC on August 20. The attacker exploited an authorization flaw in the underlying Evmos architecture to transfer BB tokens from 9 mainnet accounts without authorization from the account owners.
According to the announcement, the attacker transferred approximately 286.5 million BB tokens through 14 transactions. The impact of the incident was limited to BounceBit Chain itself, with no involvement of private key leaks, signature forgery, wallet, hardware device, or exchange account security issues. BounceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products were all unaffected.
BounceBit stated that the vulnerability stemmed from an authorization verification defect in the protocol's native modules within the Evmos architecture. When the attacker called the relevant modules through smart contracts, they bypassed the security checks that should have verified the authorization relationship of the funding account, allowing them to designate arbitrary accounts as funding sources.
After the incident, BounceBit Chain stopped producing blocks at block height 20,702,857. Subsequently, the team decided not to perform a chain upgrade but instead to permanently shut down BounceBit Chain and reissue BB as a BEP-20 token on BNB Chain.
BounceBit stated that the supply of the new BB token will be based on the on-chain snapshot taken before the first abnormal transfer (block height 20,697,260), and the 286,543,148 BB transferred by the attacker will not be counted in the new token balances. Users do not need to submit applications or migrate wallets, as the official plan is to automatically distribute the new BB to the corresponding BNB Chain addresses.
For BB in staking, BounceBit stated that it will also be restored at the snapshot time point, and token holders do not need to perform unbonding or redemption operations.
Currently, BounceBit has submitted freezing and assistance requests to relevant exchanges and reminded users to be wary of scams and not to click any BB migration or claim links that have not been officially confirmed. The team stated that they will subsequently announce the new BEP-20 BB contract address and reissuance progress.
