BounceBit, the YZi Labs-backed bitcoin restaking and CeDeFi platform, has permanently shut down its standalone Layer 1 blockchain after an attacker exploited a protocol-level authorization flaw to transfer approximately 286.5 million BB tokens from nine mainnet accounts. The tokens were valued at roughly $3.1 million to $3.3 million at the time of the incident.

The project will reissue BB as a BEP-20 token on BNB Chain using a pre-attack snapshot, excluding the unauthorized transfers from the new supply. Block production on BounceBit Chain has already ceased, ending the network’s independent operation after more than two years.

Details of the Exploit

The unauthorized transfers occurred between 21:02 UTC on August 19 and 01:54 UTC on August 20, 2026. Across 14 transactions spanning nearly five hours, the attacker moved about 286,543,148 BB tokens without the consent of the account owners.

BounceBit stated that the vulnerability allowed a smart contract caller to designate an unrelated account as the source of funds without verifying that the account had authorized the transaction. The issue originated in a protocol feature inherited from the Evmos stack on which BounceBit Chain was built. No private keys were compromised, no signatures were forged, and no wallets, hardware devices, or exchange accounts were breached.

Block production halted at height 20,702,857 at 02:36 UTC on August 20, approximately 42 minutes after the final unauthorized transfer. No further unauthorized movements occurred after the halt. The stolen amount represented roughly 23 percent of the then-circulating supply of about 1.24 billion BB tokens.

Decision to Retire the Chain

BounceBit initially considered repairing the network but ultimately chose to permanently sunset BounceBit Chain. The team cited the fact that Evmos, the underlying codebase, has been discontinued. Rebuilding on a successor framework would have required a full re-platform, re-audit, and revalidation rather than a conventional upgrade.

Most of BounceBit’s products already operate primarily on BNB Chain, and user activity has concentrated there. The project said relocating the token will allow it to focus resources on existing products instead of reconstructing the damaged network. Its CeDeFi Strategy, Promo Vaults, Prime, and real-world asset products were unaffected by the exploit and continue to function.

Token Reissuance on BNB Chain

BB will be reissued as a BEP-20 token on BNB Chain. Balances will be determined by a snapshot taken at block 20,697,260, recorded immediately before the first unauthorized transfer on August 19. The 286.5 million BB moved by the attacker will not appear in the new supply.

Users will not need to submit claims or manually migrate tokens. Corresponding balances, including staked and unbonding positions, will be credited automatically to matching addresses on BNB Chain. Transactions that occurred in the roughly five-and-a-half-hour window between the snapshot and the network halt will not be recognized in the reissued token.

BounceBit has warned users to avoid unofficial migration links and fake contracts while exchanges coordinate support for the new token. Bithumb, one of the exchanges listing BB, suspended deposits and withdrawals for the token on August 20.

The project has contacted the nine affected accounts and confirmed that balances will be restored to their pre-theft state through the snapshot process. BNB Chain will become the primary execution environment for BounceBit’s products and services going forward.