YZi Labs-backed BounceBit will shut down its Layer 1 blockchain after an attacker drained 286.5 million BB tokens from nine accounts in an exploit that exposed a flaw in the network’s authorization system.
The attack took place between Aug. 19 and 20 and did not involve the theft of private keys, according to the project. Instead, the attacker exploited a weakness in how transactions were authorized on BounceBit Chain.
The network halted block production after the unauthorized transfers. BounceBit will reissue BB as a BEP-20 token on BNB Chain, using a snapshot of balances recorded at block 20,697,260 before the attack.
The stolen tokens will not be included in the new supply. Holders do not need to take any action during the reissuance, according to BounceBit. Staked and unbonding balances will also receive credits based on the snapshot.
The attacker used primary accounts and 15 single-use contracts to exploit the flaw, allowing unauthorized accounts to become funding sources.
BounceBit said the incident did not compromise wallets, private keys, signatures, hardware devices or exchange accounts. The project will coordinate with exchanges on affected deposits and has warned holders to avoid unofficial migration links or newly issued BB contracts.
The shutdown will end BounceBit’s standalone blockchain as the project shifts its products to BNB Chain.
