BounceBit will permanently retire its standalone Layer 1 blockchain and reissue its BB token on BNB Chain after an attacker used an authorization flaw to transfer about 286.5 million BB tokens from nine wallets, the project said in a Friday update. Block production was halted roughly 40 minutes after the suspicious activity was detected.
The project plans to take a snapshot from before the attack and use it to distribute replacement BB tokens as BEP-20 assets on BNB Chain. That approach is intended to nullify the unauthorized transfers rather than preserve balances created through the exploit.
BounceBit said the incident occurred between Wednesday and Thursday and was linked to a component of the Evmos technology stack that underpinned its chain. The project estimated the tokens taken were worth about $3 million, although the dollar value is sensitive to BB’s market price and the liquidity available to trade a large amount of the token.
Authorization flaw allowed unauthorized token transfers
According to BounceBit, the vulnerability allowed a smart contract caller to specify a different account as the source of funds without confirming that the account had authorized the transaction. In practical terms, an attacker could instruct the affected system to move tokens from wallets they did not control.
The project said the breach did not involve compromised private keys, forged signatures, wallet intrusions, or hardware-device failures. The distinction places the failure in the blockchain’s transaction authorization logic rather than with individual users’ wallet security.
Nine wallets were affected before validators stopped producing blocks. Halting the chain limited the period in which further transfers could occur, but it also left BounceBit facing a larger operational question: whether an aging technical foundation could be safely repaired and maintained after the exploit.
BounceBit has chosen not to pursue that route. Its team said it would shut down the Layer 1 rather than patch, upgrade, and relaunch it.
Pre-attack snapshot will determine replacement balances
The migration plan centers on a pre-attack snapshot, a record of wallet balances at a specified point before the unauthorized transactions. Holders’ BB allocations on BNB Chain will be calculated from that earlier state, according to BounceBit.
This would restore balances for affected wallets without requiring users to submit individual recovery claims. It would also prevent wallets that received stolen BB tokens after the snapshot point from retaining those balances in the replacement token distribution.
BounceBit said it is working with trading venues to reconcile customer balances during the migration. That process will be particularly relevant for users who deposited or traded BB after the exploit, since venue records and on-chain balances may need to be aligned with the project’s snapshot-based recovery plan.
The project has not framed the migration as an optional bridge from one active network to another. It is a permanent closure of the original chain, meaning BB holders will ultimately need to rely on the BNB Chain version of the token and the migration arrangements provided by platforms supporting it.
Users should be cautious about unofficial migration tools, token-swap websites, or wallet-connection requests. Exploits and network closures often create opportunities for phishing campaigns that imitate project announcements or claim to offer early access to replacement tokens.
Evmos shutdown shaped the decision
BounceBit cited the discontinuation of Evmos in May as a major factor in retiring its own chain. Rebuilding an Evmos-based Layer 1 would require maintaining software built around an ecosystem that is no longer being actively developed in its previous form, the project said.
Evmos was designed to bring Ethereum-compatible smart contracts to the Cosmos ecosystem. BounceBit’s use of its stack allowed the project to operate a specialized network, but the model also created a dependency on infrastructure that has become harder to sustain.
Moving BB to BNB Chain reduces that operational burden by placing the token on a network where BounceBit says most of its users and products are already active. A BEP-20 token is the standard format for fungible assets on BNB Chain, allowing BB to work with the chain’s established wallets, decentralized applications, and token infrastructure.
The migration does not erase the underlying security failure. It does, though, move BounceBit away from maintaining a separate chain and gives the team a clearer recovery path based on a fixed pre-attack ledger state.
Core products were not affected, BounceBit says
BounceBit said its CeDeFi Strategy products, Promo Vaults, Prime service, and real-world asset offerings were not affected by the exploit. CeDeFi refers to products that combine centralized-finance services with decentralized-finance mechanisms, often including yield strategies and on-chain settlement features.
The project began in early 2024 as a Bitcoin restaking protocol, a model intended to put Bitcoin-linked capital to work in security or yield-generating systems. BounceBit later expanded into CeDeFi strategies and tokenized real-world assets.
It raised $6 million in seed funding co-led by Blockchain Capital and Breyer Capital, according to its earlier announcement. The project also said last year that it intended to offer tokenized stocks tied to markets in the United States, Europe, Hong Kong, and Japan.
Those product ambitions now depend on a migration that preserves user balances, gives trading platforms a workable reconciliation process, and avoids confusion between the retired native BB asset and its BNB Chain replacement. The pre-attack snapshot will become the reference point for that transition, making official timing and contract information especially relevant for holders.
Security breaches worry you? Learn how to protect funds with crypto safety standards every trader should know today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
