BounceBit Shuts Down Layer 1 Chain After $3.1 Million Token Theft

Finance.Biggo

BounceBit Shuts Down Layer 1 Chain After $3.1 Million Token Theft

First seen 22 Aug 2026, 05:17 UTC • •67.5

Article Content

1 / 5

Browse articles

ThreatCluster •August 23, 2026 at 05:02 UTC

•BounceBit lost 286.5 million BB tokens due to an exploit, worth $3.1 million.
•The attack exploited an authorization flaw in the Evmos stack, not compromising private keys.
•BounceBit will migrate to BNB Chain and reissue BB tokens based on a snapshot before the theft.

BounceBit announced the permanent retirement of its Layer 1 blockchain following a $3.1 million exploit that drained 286.5 million BB tokens from nine accounts. The attack occurred between August 19 and August 20, 2026, exploiting an authorization flaw in the Evmos stack, which allowed the attacker to transfer tokens without consent. No private keys or wallets were compromised, but the incident represented a significant 23% of BB's circulating supply. BounceBit will migrate to BNB Chain, reissuing BB tokens as BEP-20 tokens based on a pre-attack snapshot. The decision to retire the chain was influenced by the discontinuation of Evmos and a shift in user activity towards BNB Chain. Affected users will have their balances restored to pre-theft levels.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 50d ago How this analysis works

Timeline

2026-08-19

Unauthorized transactions initiated

An attacker began draining BB tokens from nine accounts, exploiting a protocol flaw.

2026-08-20

Token theft completed

The attacker siphoned 286.5 million BB tokens across 14 transactions before the network was halted.

2026-08-21

BounceBit announces chain retirement

BounceBit confirmed the permanent shutdown of its Layer 1 chain and plans to migrate to BNB Chain.

2026-08-21

Details of the exploit disclosed

BounceBit explained the authorization flaw and confirmed no private keys were compromised.

More articles in this cluster (4)

Threat Graph

7 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Organization (1)

BounceBit

Weakness (2)

CWE-287 - Improper Authentication
CWE-862 - Missing Authorization

Affected Platform (3)

BNB Chain
BounceBit Chain
Evmos

Relationships

Data Breach targets BNB Chain
Data Breach targets BounceBit Chain
Data Breach targets Evmos
Data Breach related to BounceBit
Data Breach related to CWE-287 - Improper Authentication
Data Breach related to CWE-862 - Missing Authorization

Following this threat?

Track BounceBit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…