BounceBit Chain update on vulnerability attack progress: will permanently halt the chain and migrate to BNB Chain
The cross-chain yield protocol BounceBit has released a security incident announcement stating that its blockchain network experienced a protocol-level vulnerability attack from August 19, 21:02 UTC to August 20, 01:54 UTC. The attacker exploited an authorization flaw in the underlying architecture of Evmos to transfer BB tokens from 9 mainnet accounts without the account owners' authorization. According to the announcement, the attacker transferred approximately 286.5 million BB through 14 transactions.The impact of the incident is limited to the BounceBit Chain itself and does not involve issues related to private key leakage, signature forgery, wallet, hardware device, or exchange account security. BounceBit's CeDeFi Strategy, Promo Vaults, Prime, and RWA products were not affected.BounceBit stated that the vulnerability originated from a defect in the authorization verification of the protocol's native module within the Evmos architecture. The attacker bypassed the security checks that were supposed to verify the authorization relationship of the funding source account when calling the relevant module through a smart contract, allowing them to designate any account as the source of funds.After the incident, the BounceBit Chain stopped block production at block height 20,702,857. The team then decided not to upgrade the chain but to permanently shut down the BounceBit Chain and reissue BB as a BEP-20 token based on the BNB Chain. BounceBit stated that the new BB token supply will be based on an on-chain snapshot taken before the first abnormal transfer (block height 20,697,260), and the 286,543,148 BB transferred by the attacker will not be included in the new token balance.Users do not need to submit applications or migrate wallets; the official plan is to automatically distribute the new BB to the corresponding BNB Chain addresses. For staked BB, BounceBit stated that it will be restored at the snapshot time, and holders do not need to perform unbinding or redemption operations. Currently, BounceBit has submitted requests for freezing and assistance to relevant exchanges and has reminded users to be vigilant against scams and not to click on any BB migration or claim links that have not been officially confirmed. The team stated that they will announce the new BEP-20 BB contract address and reissuance progress in the future.