Attackers transferred 286.5 million BB tokens, BounceBit plans to connect to the BNB chain...

How did the BounceBit attack happen?

BounceBit will permanently shut down its independent Tier 1 blockchain and migrate its native tokens BB to the BNB chain. Earlier, an attacker exploited an authorization vulnerability to transfer about $3 million worth of tokens without cracking private keys or wallets. The incident occurred between Wednesday and Thursday. BounceBit suspended block production after the attackers transferred approximately 286.5 million BBs from nine accounts in approximately 40 minutes.

BounceBit said the vulnerability originated from a feature in the Evmos stack it used to build the blockchain. The vulnerability allows a smart contract caller to designate another account as a source of funds without verifying that the account has authorized the transaction. This is critical because attackers do not need to steal wallet credentials or forge user signatures. "No private keys were compromised, no signatures were forged, and no wallets, hardware devices or exchange accounts were compromised," BounceBit said. The company said its CeDeFi strategy, Promo Vaults, Prime products and real-world asset products were not affected by the incident.

Why did BounceBit shut down its first-layer network?

BounceBit did not choose to fix the vulnerability and restart the existing network, but decided to shut down the chain completely. BB tokens will be reissued on the BNB chain as BEP-20 tokens, with their balance based on a snapshot before the unauthorized transfer occurred. This snapshot approach effectively excludes attacker transactions from the allocation of replacement tokens. Existing holders will automatically receive reissued BB tokens based on the balance recorded before the attack. BounceBit is also working with exchanges to correct customer balances and ensure users do not suffer losses from attacks.

This decision reflects a technical issue that goes beyond the attack itself. BounceBit said rebuilding its Evmos-based blockchain will be very difficult because Evmos itself ceased operations in May. As a result, continuing to maintain a separate Layer 1 will require additional engineering work for infrastructure that no longer has the same upstream support. In addition, most BounceBit products and users are already accessible via the BNB chain, which reduces the practical need to rebuild a separate network. "Maintaining a separate Layer 1 is no longer the most effective way to serve users," BounceBit said.

Note to Investors

BounceBit's response turned a security incident into a permanent infrastructure change. If snapshots and exchange balance adjustments go as planned, BB holders may be able to avoid direct losses, but closing the independent chain means part of the project's original architecture will no longer exist.

What does migration mean for BB holders?

For token holders, the current focus is on the re-issuance process. Using pre-attack snapshots means legal balances can be recreated on the BNB chain, while 286.5 million BBs transferred through unauthorized transactions will be excluded. This process also reduces the need for users to interact with damaged or deactivated networks. If the exchange is able to successfully verify customer balances, holders using a centralized platform may automatically receive replacement tokens without having to manually complete the migration.

The more difficult issue concerns the usefulness of BB after migration. Tokens issued on the BNB chain can continue to be used in BounceBit products, but the project will no longer run a separate underlying network around it. This will transform BB's role from a native asset in a standalone Layer 1 to a token running on an external blockchain infrastructure. The migration may reduce infrastructure costs and reduce the engineering burden associated with maintaining verification nodes, consensus software, and network upgrades. But at the same time, it also makes BounceBit rely more on the BNB chain for transaction execution and settlement.

Has this closure changed BounceBit's business model?

BounceBit was launched in early 2024 as a Bitcoin re-pledge agreement and received a $6 million seed round of financing jointly led by Blockchain Capital and Breyer Capital. Subsequently, its business expanded into CeDeFi revenue products and tokenized real-world assets. The company also announced plans to offer tokenized shares from markets such as the United States, Europe, Hong Kong and Japan. These products don't necessarily require BounceBit to operate its own Layer 1, especially when users and mobility are already concentrated on the BNB chain. As a result, the attack appears to have accelerated a decision that also has economic considerations.

Running a stand-alone blockchain requires continued investment in development, security, verification nodes and infrastructure, and if most user activity occurs elsewhere, the benefits are difficult to rationalize. The closure also reveals the broader risks faced by projects built on discontinued or insufficiently maintained blockchain frameworks. When the original development ecosystem no longer actively supports it, vulnerabilities in the underlying software will become difficult to handle. The next test for BounceBit will be whether token migration, exchange balance adjustments and product operations can proceed smoothly without further disruption. If this process is successful, users can still avoid direct financial losses due to this attack, although the original Layer 1 of the project will be permanently eliminated.