YZi Labs-Backed BounceBit Shuts Down Chain After 286M BB Exploit

YZi Labs-backed BounceBit is permanently shutting down its own Layer 1 blockchain after an attacker moved 286.5 million BB tokens (worth more than $3.1 million) through a flaw in the network’s authorization system. 

The project will instead reissue BB tokens on BNB Chain, ending BounceBit’s standalone chain after more than two years.

BounceBit Ends Its Own Blockchain After Exploit

In an announcement on X, BounceBit Chain said that they have stopped producing new blocks at 20,702,857 after the attack exposed a problem in its underlying Evmos-based system. 

The flaw allowed an attacker to name another account as the source of funds without getting approval from that account. Then the attacker moved about 286,543,148 BB from nine mainnet accounts without the owners’ approval.

BounceBit team said that no private keys were stolen, no signatures were forged, and no wallets or exchange accounts were hacked. The issue was inside the blockchain’s own software.

However, the project initially considered repairing the network. Perhaps it later decided that rebuilding the chain would take much more work because the Evmos codebase used by BounceBit has been discontinued.

BB Token Will Move to BNB Chain

BounceBit has decided not to rebuild or upgrade its Layer 1. Instead, the project will issue BB as a BEP-20 token on BNB Chain.

The new balances will be based on a snapshot taken at block 20,697,260, before the first unauthorized transfer. The 286.5 million BB moved by the attacker will not be included in the new token supply.

BounceBit said users will not need to manually apply for the new tokens. The project plans to credit the corresponding BNB Chain addresses automatically. Staked and unbonding BB balances will also be handled using the pre-attack snapshot.

Why BounceBit Chose BNB Chain

The shutdown does not mean BounceBit is closing its wider business.

Most of its products already operate around BNB Chain, while user activity is also concentrated there. The team said moving away from its own Layer 1 will allow it to put more resources into its existing products instead of rebuilding the damaged network.

The project also said its CeDeFi, Prime, and RWA products were not affected by the exploit and will continue to function.

BounceBit has warned users to avoid unofficial migration links and fake contracts while exchanges coordinate support for the new BB token.