Key Highlights
- BounceBit will permanently shut down its chain after an attacker stole 286.5 million BB from nine accounts.
- BB will be reissued on BNB Chain, with user balances restored based on a snapshot taken before the attack.
- The exploit was caused by a flaw in BounceBit Chain’s authorization system, not stolen private keys or compromised user wallets.
BounceBit, a CeDeFi (centralized-decentralized finance) platform and Layer 1 blockchain, has decided to permanently shut down BounceBit Chain after an attacker exploited a flaw in the network and moved about 286.5 million BB from nine accounts.
The attack happened between August 19 and 20, 2026, forcing BounceBit to stop the chain and move BB to BNB Chain.
According to the update shared in a Friday post on X, the incident started at 21:02 UTC on August 19, when the attacker began making unauthorized transfers. BounceBit said 286,543,148 BB was moved across 14 transactions over four hours and 52 minutes. The last unauthorized transfer happened at 01:54 UTC on August 20.
How the attacker moved 286.5 million BB
The attacker did not steal any private keys or break into users’ wallets. No signatures were forged, and no wallet software, hardware devices or exchange accounts were compromised. The problem was inside the chain itself.
The company said the attacker found a weakness in one of BounceBit Chain’s built-in features. The feature was meant to allow a designated account to provide tokens for a vesting plan. However, a check that should have confirmed that the account had approved the transaction was not working correctly.
This allowed the attacker to choose another account as the source of the funds. In simple terms, the system failed to properly check whether the person asking for the transfer had permission to take money from the account being charged.
Nine mainnet accounts were affected. BounceBit said all nine account holders have been contacted and will have their balances restored through the reissuance process.
BounceBit stops the chain after the attack
After detecting the attack, BounceBit stopped block production at 02:36:37 UTC on August 20. This happened about 42 minutes after the final unauthorized transfer. The halt stopped further changes to the chain, and BounceBit said no additional unauthorized transfers happened afterward.
At first, BounceBit said it had paused the network while preparing a fix. It also temporarily stopped BB deposits and withdrawals on exchanges. But after reviewing the situation, the company decided that fixing the existing chain was not the best option.
Why BounceBit decided to shut down its chain
BounceBit said the network was built using the Evmos stack, which has since been discontinued. Restarting the chain would therefore require more than a normal upgrade. The company would need to rebuild, audit and test the network before allowing it to handle user funds again.
Instead, BounceBit will permanently shut down BounceBit Chain and reissue BB as a BEP-20 token on BNB Chain. The company said BNB Chain already has most of BounceBit’s user activity, as well as wider wallet support, deeper liquidity and a larger group of users and developers.
How users will get their BB back
To restore balances, BounceBit will use a snapshot taken at block 20,697,260 at 21:02:35 UTC on August 19, just before the attack began. The 286,543,148 BB moved by the attacker will not be included in the new token.
Users will receive the amount of BB shown in their balance at the snapshot. Transactions made during the roughly five-and-a-half-hour period after the snapshot will be reversed. Staked and unbonding BB will also be included if they were recorded at the snapshot.
BounceBit said users do not need to submit a claim or move their tokens at this stage. The company also warned users to avoid fake claim websites and unverified BB tokens. “There is currently no claim site or claim form,” BounceBit said, adding that users should not sign transactions or connect their wallets to sites claiming to handle the reissuance.
BounceBit attack adds to growing crypto losses
The BounceBit attack also comes as crypto platforms face a growing number of security incidents this year.
Recent data from PeckShield shows that eight major bridge and cross-chain exploits resulted in a combined $328.6 million through mid-May 2026. By mid-April, total DeFi hack losses for the year had already passed $750 million, driven in part by the $292 million Kelp DAO attack and the $285 million Drift Protocol incident.
The attacks continued into the following months. In June, 40 separate security incidents caused $75.9 million in losses, including a $31 million breach involving Humanity Protocol.
The Crypto Times also reported that crypto losses topped $47 million in a single week in July, with AFX Trade, Wanchain and Verus among the platforms affected. The Verus Ethereum Bridge lost about $7.54 million on July 23, marking the second time the same import path had been exploited in just over two months.
These incidents have helped push 2026 crypto security losses above $1 billion with the losses majorly coming from different types of attacks, including bridge exploits, oracle manipulation, compromised keys and contract ownership takeovers.
BounceBit’s case is different in one important way. The attacker did not need to steal a user’s private key or break into a wallet. Instead, the weakness was inside the blockchain’s own authorization system. That flaw allowed the attacker to make the network treat another account as the source of funds.
For BounceBit, the result was serious enough that the company decided not to rebuild the chain. Instead, it will shut down the BounceBit Chain completely and move BB to BNB Chain.
Also Read: User Loses 1,010 ETH in Phishing Attack via Hijacked Tornado Cash Domain
