Key Takeaways:
An attacker drained 286.5 million BB tokens worth about $3 million from BounceBit, forcing the bitcoin restaking protocol to permanently retire its Layer 1 chain.
BounceBit said the vulnerability stemmed from a flaw in the Evmos stack its chain was built on, allowing a smart contract caller to designate a different account as the source of funds without verifying the account authorized the transaction. "No private key was compromised, no signature was forged, and no wallet, hardware device, or exchange account was breached," the project said in a Friday update.
The attacker moved the tokens from nine wallets across 14 transactions before block production was halted about 40 minutes later. BounceBit's CeDeFi Strategy, Promo Vaults, Prime, and real-world asset products were unaffected, it said.
Rather than patch and upgrade the network, BounceBit will reissue BB as a BEP-20 token on BNB Chain using a snapshot at block 20,697,260 taken before the attack, canceling all unauthorized transfers. The project said rebuilding the Evmos-based Layer 1 would be extremely difficult because Evmos itself was discontinued in May, and most of its products and users already operate on BNB Chain.
Migration to BNB Chain
BounceBit said it is working with exchanges to fix customer balances so they do not take losses from the exploit. Holders do not need to take any action during the reissuance, and staked and unbonding balances will receive credits based on the snapshot. The project warned holders to avoid unofficial migration links or newly issued BB contracts.
"Maintaining a standalone Layer 1 is no longer the most effective way to serve our users," BounceBit said.
BounceBit launched in early 2024 as a bitcoin restaking protocol and raised $6 million in seed funding co-led by Blockchain Capital and Breyer Capital. The platform later expanded into CeDeFi yield strategies and tokenized real-world assets, announcing last year it planned to offer tokenized stocks from the U.S., Europe, Hong Kong, and Japan.
The exploit adds to a growing pattern of smaller blockchain protocols moving to established networks after security failures, shifting the risk conversation onto larger chains like BNB Chain. For BB holders, the reissuance resets the token's technical foundation while preserving ownership records for those not involved in the incident.
This article is for informational purposes only and does not constitute investment advice.
