From August 19 to August 20, 2026, an attacker withdrew BB from nine primary accounts on the BounceBit Chain network, exploiting an authorization vulnerability in one of the protocol’s built-in modules. The flaw allowed specifying an arbitrary account as a funding source without requiring owner confirmation. Private keys, signatures, wallets, and exchange accounts were not compromised—in fact, the issue was at the protocol level.
Key facts:
- 286,543,148 BB were withdrawn in 14 transactions over nearly five hours.
- Block production was halted at height 20,702,857 (02:36 UTC on August 20); the network has been offline ever since.
- Only nine regular accounts with balances were affected; CeDeFi Strategy, Promo Vaults, Prime, and RWA products were not impacted by the incident.
- The funds passed through two main attacker addresses and 15 one-time contracts, then were fragmented and partially sent to exchanges; the team has submitted requests for freezing the funds.
Team’s decision: BounceBit Chain is being permanently shut down. The reason is that the network was built on a fork of Evmos, development of which has been discontinued. Therefore, a full upgrade would require rebuilding and re-auditing from scratch. Instead, BB will be reissued as a BEP-20 token on the BNB Chain network, where most of the products and user activity have already been migrated.
How the balance is calculated: The snapshot was taken at block 20,697,260 (21:02:35 UTC on August 19)—the moment immediately before the first unauthorized transaction. The attacker’s funds are not included in this snapshot. All BB transactions on BounceBit Chain after this point and up until the network’s shutdown (about 5.5 hours) are canceled: if tokens were purchased during this period, they will be returned to the seller; if they were sent, they will be returned to the sender.
Staked and unstaking BB at the time of the snapshot are treated as liquid and will be credited to the same address—there’s no need to unstake them, as the network isn’t operational anyway.
Holders don’t need to take any action for now.
Bouncebit is a BTC restaking protocol and a CeDeFi protocol that allows earning yield from staking BTC on DeFi or CeFi platforms.
Investments: $6 million from Blockchain Capital, NGC Ventures, CMS Holdings, OKX Ventures, and others.