The YZi-backed bitcoin restaking firm BounceBit announced today that it is shutting down its blockchain after hackers exploited an authorization vulnerability and stole over $3.1 million of its BB token.
BounceBit claims that between August 19 and August 20, attackers were able to move 286 million BB tokens out of nine of BounceBit Chain’s wallets without authorization.
Evmos stack caused exploit
An authorization flaw in the vesting and lockup account module hosted by Evmos, and utilized by BounceBit Chain, seemingly led to the exploit.
BounceBit says the attacker sent an estimated 254 million BB tokens to one “major” crypto exchange, almost 10 million BB tokens to another exchange, and 18.5 million BB tokens remain sitting in a consolidated address.
Read more: Aave TVL still down 43% since KelpDAO hack
BounceBit rules out network upgrade
BounceBit claims that it is sunsetting its blockchain after a technical review and will not be able to implement a network upgrade since it is built on the already discontinued Evmos infrastructure.
It said, “Moving our fork onto a successor codebase would therefore not be a conventional upgrade, but a substantial re-platform requiring a full rebuild, re-audit, and revalidation before it could safely carry user assets again.”
BB tokens will now turn into BEP-20 tokens
Every other BB token, bar the attackers, will be reissued as a BEP-20 token on BNB Chain. A snapshot of the block before the exploit will be used to determine the sum of BEP-20 tokens a user will receive.
BounceBit also claims it has asked crypto exchanges to freeze specific addresses that won’t affect the funds of innocent users.
Read more: Tone Vays says his PC looks ‘OK’ after giving hackers access
BB token holders were told that they won’t need to do anything and that they should be cautious of scammers offering help.
BounceBit raised $6 million in 2024 as part of a seed funding round co-led by Blockchain Capital and Breyer Capital. According to the Binance Square moderator “Tang Hua,” YZi Labs invested later in April 2024.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
