BounceBit is shutting down its standalone Layer 1 blockchain for good. The project will migrate to BNB Chain after an attacker exploited an authorization flaw and walked away with roughly $3 million worth of its native BB tokens.
The exploit played out between Wednesday and Thursday, the project said in a Friday update. The attacker moved approximately 286.5 million BB out of nine wallets. Block production was halted roughly 40 minutes later. BounceBit frames the shutdown as a strategic pivot, not a retreat. Most of its products and users already live on BNB Chain, the project said, which made migration the obvious move.
“No private key was compromised, no signature was forged, and no wallet, hardware device, or exchange account was breached,” BounceBit said in its Friday update. The vulnerability was tied to a feature of the Evmos stack that BounceBit’s chain was built on, the team said. The flaw let a smart contract caller name a different account as the source of funds, with no check that the account had authorized the transaction.
In practice, the attacker never had to crack a wallet. They used the protocol’s own code to move tokens they never owned.
Rebuilding the Evmos-based Layer 1 was never a realistic option. Evmos itself was discontinued in May, leaving BounceBit’s chain tethered to a stack whose maintainers had already walked away. “Maintaining a standalone Layer 1 is no longer the most effective way to serve our users,” BounceBit said.
The plan now: reissue BB as a BEP-20 token on BNB Chain, using a pre-attack snapshot to cancel every unauthorized transfer. BounceBit said it is working with exchanges to correct customer balances so users don’t absorb losses from the exploit. The CeDeFi Strategy, Promo Vaults, Prime, and real-world asset products were unaffected.
BounceBit launched in early 2024 as a bitcoin restaking protocol. It raised $6 million in seed funding co-led by Blockchain Capital and Breyer Capital, then expanded into CeDeFi yield strategies and tokenized real-world assets. Last year it announced plans to offer tokenized stocks from the U.S., Europe, Hong Kong and Japan.
What remains unclear is the exact timeline for the reissued BB distribution and whether exchanges have finished processing balance fixes. The attacker’s identity has not been disclosed. The project has not said whether any stolen funds have been recovered beyond the planned snapshot cancellation. A firm completion date for the BNB Chain migration has not been set.
Holders, as ever, are divided.
