BounceBit to Permanently Shut Down L1 After 286.5 Million BB Exploit

BounceBit will permanently shut down its Layer 1 blockchain after an attacker exploited a protocol-level authorization flaw and moved approximately 286.5 million BB from nine mainnet accounts without authorization.

The project said the incident affected its Evmos-based chain but did not compromise private keys or wallets. BounceBit also said its CeDeFi, Prime and RWA products were unaffected by the exploit.

Following the incident, BounceBit plans to permanently sunset BounceBit Chain and reissue BB as a BEP-20 token on BNB Chain. The new token will be based on a pre-exploit snapshot, while the 286.5 million BB moved by the attacker will not be transferred to the new asset.

The details were reported in information shared by @WuBlockchain on X.

BounceBit Identifies Protocol-Level Authorization Flaw

According to BounceBit, the attacker exploited a flaw at the protocol level that affected authorization mechanisms on its Evmos-based blockchain.

The exploit enabled the unauthorized movement of approximately 286.5 million BB from nine mainnet accounts.

BounceBit emphasized that the incident did not involve the compromise of private keys or individual wallets. This distinction indicates that the attack targeted an issue within the blockchain's protocol-level authorization system rather than obtaining direct access to users' private credentials.

The project also said that its CeDeFi, Prime and RWA products were not affected by the incident.

The scale of the unauthorized transfer prompted BounceBit to take the more significant step of discontinuing its existing Layer 1 network rather than continuing to operate the affected chain.

BounceBit Chain to Be Permanently Sunset

BounceBit said it will permanently shut down BounceBit Chain and transition BB to BNB Chain.

Under the plan, BB will be reissued as a BEP-20 token on BNB Chain using a snapshot taken before the exploit occurred.

The approach is intended to separate the new token from the unauthorized transactions that occurred during the incident.

As part of the transition, the approximately 286.5 million BB moved by the attacker will not carry over to the new token.

The use of a pre-exploit snapshot means the new token distribution will be determined based on balances recorded before the unauthorized movement of funds.

BounceBit's decision effectively ends the existing BounceBit Chain as its Layer 1 infrastructure and moves the BB token to an established blockchain environment.

BounceBit's Funding and Investor Background

BounceBit had attracted investment from several prominent firms before the exploit.

The project raised $6 million in a 2024 seed round co-led by Blockchain Capital and Breyer Capital. The round also included participation from OKX Ventures and HTX Ventures.

BounceBit later received a separate investment from Binance Labs, which is now known as YZi Labs.

The funding supported the project's development as it built infrastructure around Bitcoin-related decentralized finance and other blockchain applications.

The decision to permanently sunset its own Layer 1 represents a significant change to that original infrastructure strategy markets

Rather than attempting to continue operating the affected chain, the project will move BB to BNB Chain through a new BEP-20 token.

Private Keys and Wallets Were Not Compromised

One of the key details from BounceBit's announcement is that the incident did not involve compromised private keys or wallets.

Private keys are critical security credentials that allow users to control blockchain assets. A compromise of private keys can potentially give attackers direct access to individual wallets.

BounceBit instead attributed the incident to a protocol-level authorization flaw in its chain.

The project also stated that its CeDeFi, Prime and RWA products were unaffected, separating those services from the infrastructure vulnerability finance that led to the unauthorized movement of BB.

The distinction is important because the incident was concentrated around BounceBit Chain and the BB assets held through the affected mainnet accounts.

What Happens to BB After the Exploit

The transition will move BB from BounceBit Chain to BNB Chain through a new BEP-20 version of the token.

The new asset will rely on the pre-exploit snapshot, while the tokens transferred by the attacker will be excluded from the new issuance.

This means the approximately 286.5 million BB associated with the exploit will not be recognized in the new token supply.

For BounceBit, the migration provides a way to discontinue the compromised Layer 1 while maintaining a version of BB on another blockchain.

The move also changes the technical foundation supporting the token, replacing BounceBit Chain with BNB Chain.

The incident underscores the risks associated with protocol-level vulnerabilities in blockchain networks, where authorization flaws can affect large amounts of digital assets without requiring the compromise of individual users' private keys.

BounceBit's permanent shutdown of its Layer 1 and migration of BB to BNB Chain marks a substantial response to the exploit, while the project's other products remain unaffected according to its announcement.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.