{"investigation":{"slug":"bouncebit-l1-exploit-and-chain-shutdown-august-2026","entity_name":"BounceBit L1 Exploit and Chain Shutdown (August 2026)","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"On August 19-20, 2026, an attacker exploited a protocol-level authorization flaw inherited from the Evmos technology stack to move 286,543,148 BB tokens — approximately 23% of circulating supply, valued at roughly $3 million — from nine mainnet accounts across 14 transactions, without compromising any private keys. BounceBit, a Bitcoin restaking and CeDeFi yield platform founded in 2023 and backed by Binance Labs (later rebranded YZi Labs), Blockchain Capital, and Breyer Capital, chose to permanently retire its Layer 1 blockchain rather than attempt a rebuild on the discontinued Evmos codebase. BB is being reissued as a BEP-20 token on BNB Chain using a pre-exploit snapshot that excludes the attacker's transfers, with the permanent chain retirement eliminating the token's original L1 utility roles including gas, validator staking, and governance.","sections":[{"content":"BounceBit is a Bitcoin restaking and CeDeFi yield protocol founded in December 2023 by Jack Lu, formerly a partner at NGC Ventures and co-founder of the decentralized auction platform Bounce. In February 2024 BounceBit raised $6 million in seed funding co-led by Blockchain Capital and Breyer Capital, with participation from dao5, CMS Holdings, OKX Ventures, Mirana Ventures, DeFiance Capital, and others. Binance Labs (subsequently rebranded YZi Labs in early 2024) separately invested in the project. BounceBit's proof-of-stake Layer 1 blockchain was built on a fork of the Evmos stack, an Ethereum Virtual Machine hub in the Cosmos ecosystem, and supported BTC, BTCB, and the native BB token as staking assets. By April 2024 the protocol reported a total value locked exceeding $1 billion, drawing attention as one of the early Bitcoin restaking entrants. Its principal products — CeDeFi Strategy, Promo Vaults, Prime operations, and RWA products — operated substantially on BNB Chain infrastructure alongside the standalone Layer 1.","heading":"Background: BounceBit Protocol","sources":[{"url":"https://www.theblock.co/post/279603/bitcoin-restaking-protocol-bouncebit-funding-tvl","name":"Bitcoin restaking protocol BounceBit raises $6 million in seed funding — The Block","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/binance-labs-bouncebit-btc-restaking/","name":"Binance Labs invests in Bitcoin restaking protocol BounceBit — CryptoBriefing","type":"news_article","credibility":2},{"url":"https://www.prnewswire.com/news-releases/bouncebit-raises-6m-in-seed-funding-round-to-build-bitcoin-restaking-infrastructure-302075090.html","name":"BounceBit raises $6M seed round — PR Newswire","type":"official","credibility":1}],"severity":"low"},{"content":"The vulnerability exploited on August 19-20, 2026 corresponds to a class of flaws in the Evmos fundVestingAccount precompile mechanism. In the affected logic, a user or contract could create a vesting account designating an arbitrary third-party address as the funder. The authorization check was then evaluated against the contract caller's address rather than the specified funder's address, meaning no approval from the funder was ever verified. This allowed an attacker to withdraw tokens from any designated account without that account's consent. The flaw was publicly disclosed as CVE-2024-39696 (rated critical) in 2024 and was patched in Evmos version 19.0.0. According to one report, BounceBit's chain code had not been updated since February 2025, meaning the fix was available but not applied. BounceBit's own post-mortem attributed the incident to 'protocol-level authorization logic inherited from the Evmos stack,' confirming that private keys, signatures, wallets, hardware devices, and exchange accounts were not compromised. The attacker used 15 single-use contracts in conjunction with nine primary accounts to execute the transfers.","heading":"The Exploit: Authorization Flaw in the Evmos Stack","sources":[{"url":"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c","name":"CVE-2024-39696: Evmos fundVestingAccount precompile authorization flaw — GitHub Security Advisory","type":"other","credibility":1},{"url":"https://crypto-economy.com/bouncebit-shuts-down-blockchain-after-3m-exploit-moves-to-bnb-chain/","name":"BounceBit shuts down blockchain after $3M exploit — Crypto Economy","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/bouncebit-abandons-layer-1-after-286-million-token-exploit-leaving-token-holders-in-limbo/","name":"Chain shutdown strips BounceBit token utility after authorization flaw — CryptoSlate","type":"news_article","credibility":2},{"url":"https://cryip.co/bouncebit-shuts-down-its-blockchain-after-exploit-drains-a-quarter-of-bbs-circulating-supply/","name":"BounceBit shuts down its blockchain after exploit drains a quarter of BB's circulating supply — Cryip","type":"news_article","credibility":3}],"severity":"critical"},{"content":"Unauthorized transfers began at approximately 21:02 UTC on August 19, 2026. The attacker executed 14 transactions over a period of four hours and 52 minutes, with the final unauthorized transfer occurring at 01:54 UTC on August 20. Block production on BounceBit Chain was halted at block height 20,702,857 at 02:36 UTC on August 20, approximately 42 minutes after the last illicit transaction. In total, 286,543,148 BB tokens were moved from nine mainnet accounts, representing approximately 23% of the token's circulating supply at the time. The dollar value at the time of the exploit was approximately $3 million, though some outlets report figures as low as $2.8 million and as high as $3.1 million, reflecting price variation during the five-hour attack window. Protos reporting indicates that approximately 254 million BB tokens were sent to one major centralized exchange, nearly 10 million BB tokens were sent to a second exchange, and approximately 18.5 million BB tokens remained in a consolidated attacker-controlled address. BounceBit coordinated with centralized exchanges to freeze attacker-linked deposits.","heading":"Incident Timeline and Scope","sources":[{"url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/","name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/","name":"BounceBit shuts down chain after 286M BB exploit — CryptoTimes","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485","name":"BounceBit to sunset blockchain, migrate to BNB Chain after $3 million exploit — The Block","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Rather than patching or upgrading the BounceBit L1 network, the team announced on August 21, 2026 that it would permanently retire the chain. The stated rationale was that Evmos — the upstream stack on which BounceBit Chain was built — was itself discontinued in May 2026. BounceBit stated that migrating its fork to a successor codebase 'would therefore not be a conventional upgrade, but a substantial re-platform requiring a full rebuild, re-audit, and revalidation,' rendering a prompt restoration impractical. The team also cited that the majority of its products and user activity had already migrated to BNB Chain. The permanent shutdown eliminates BB's original Layer 1 utility roles, including its function as network gas, validator staking collateral, staking rewards mechanism, and governance token — none of which have confirmed one-for-one equivalents in the BNB Chain migration. The loss of these utility roles is a structurally significant downgrade for the token.","heading":"Permanent Chain Retirement","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485","name":"BounceBit to sunset blockchain, migrate to BNB Chain after $3 million exploit — The Block","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/","name":"BounceBit abandons its Layer 1 after 286.5M BB exploit — AMBCrypto","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/bouncebit-abandons-layer-1-after-286-million-token-exploit-leaving-token-holders-in-limbo/","name":"Chain shutdown strips BounceBit token utility — CryptoSlate","type":"news_article","credibility":2}],"severity":"critical"},{"content":"BounceBit announced that BB will be reissued as a BEP-20 token on BNB Chain using a pre-exploit state snapshot taken at block 20,697,260, timestamped 21:02:35 UTC on August 19, 2026 — immediately before the first unauthorized transfer. The 286,543,148 tokens moved by the attacker are excluded from the new supply. Staked and unbonding balances at the snapshot block are credited to holders. Addresses holding 10 BB or more receive automatic distributions; balances below 10 BB are reserved for a later claim portal. As of the time of reporting, the BEP-20 contract address had been deployed on BNB Chain but withheld pending exchange due diligence, and no firm distribution timeline had been announced. BounceBit warned holders to 'avoid unofficial migration links or newly issued BB contracts.' Exchange users were advised to await venue-specific restart notices, with BounceBit coordinating directly with exchanges to reconcile affected customer balances.","heading":"Token Migration to BNB Chain","sources":[{"url":"https://pro.edgex.exchange/news/article/bouncebit-shuts-down-chain-after-bb-token-exploit","name":"BounceBit shuts down layer 1 after authorization exploit, will reissue BB on BNB Chain — EdgeX","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/bouncebit-abandons-layer-1-after-286-million-token-exploit-leaving-token-holders-in-limbo/","name":"Chain shutdown strips BounceBit token utility — CryptoSlate","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/33331676/","name":"YZi Labs-Backed BounceBit to Shut Down L1 After 286.5M BB Exploit — CryptoNews","type":"news_article","credibility":2}],"severity":"high"},{"content":"Several compounding risk factors characterize this incident. First, CVE-2024-39696 was a publicly disclosed, critical-rated Evmos vulnerability patched in version 19.0.0 in 2024; according to one report, BounceBit's chain had not incorporated this patch before the exploit occurred. Second, Evmos was discontinued in May 2026, meaning the upstream project that could have issued additional guidance or emergency patches was no longer active. Third, the exploit targeted a protocol-level authorization module — the fundVestingAccount precompile — rather than individual user wallets, meaning no individual user action could have prevented the loss. Fourth, the five-hour attack window before block production was halted raises questions about monitoring infrastructure. The broader August 2026 exploit environment is also notable: reporting by CryptoTimes placed BounceBit alongside Maya Protocol, The Sandbox, and Term Labs as part of a wave of exploits that drained approximately $15 million collectively during a single week.","heading":"Security and Infrastructure Risk Factors","sources":[{"url":"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c","name":"CVE-2024-39696: Evmos fundVestingAccount precompile authorization flaw — GitHub Security Advisory","type":"other","credibility":1},{"url":"https://www.cryptotimes.io/2026/08/24/crypto-hacks-drain-15m-in-a-week-as-maya-bouncebit-sandbox-and-term-labs-fall/","name":"Crypto Hacks Drain $15M in a Week as Maya, BounceBit, Sandbox and Term Labs Fall — CryptoTimes","type":"news_article","credibility":2},{"url":"https://cryip.co/bouncebit-shuts-down-its-blockchain-after-exploit-drains-a-quarter-of-bbs-circulating-supply/","name":"BounceBit shuts down its blockchain after exploit drains a quarter of BB's circulating supply — Cryip","type":"news_article","credibility":3}],"severity":"high"},{"content":"The 286.5 million BB tokens transferred represented approximately 23% of the token's circulating supply at the time of the exploit, a supply shock that is structurally significant regardless of the approximately $3 million USD value. The total supply of BB is reported at 2.1 billion tokens with a circulating supply at the time of roughly 1.24 billion. Because the BEP-20 reissuance excludes the attacker's tokens, the effective circulating supply will be reduced post-migration. However, the migration simultaneously eliminates BB's staking, gas, and governance utility on the retired L1. No court filing, regulatory action, or law enforcement referral related to this incident had been publicly reported as of late August 2026. No recovery of funds from the attacker had been confirmed. BounceBit stated that isolated business units, including CeDeFi Strategy, Promo Vaults, Prime operations, and RWA products, suffered no losses as they operated on separate infrastructure.","heading":"Token Holder Impact and Market Context","sources":[{"url":"https://cryip.co/bouncebit-shuts-down-its-blockchain-after-exploit-drains-a-quarter-of-bbs-circulating-supply/","name":"BounceBit shuts down its blockchain after exploit drains a quarter of BB's circulating supply — Cryip","type":"news_article","credibility":3},{"url":"https://cryptorank.io/news/feed/60ed5-bouncebit-shuts-down-l1-after-3m-exploit-putting-bb-traders-on-alert","name":"BounceBit shuts down L1 after $3M exploit, putting BB traders on alert — CryptoRank","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/bouncebit-shuts-down-blockchain-after-3m-exploit-moves-to-bnb-chain/","name":"BounceBit shuts down blockchain after $3M exploit — Crypto Economy","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2023-12","event":"BounceBit founded by Jack Lu; protocol built on Evmos-based Layer 1 blockchain.","source":"The Block","source_url":"https://www.theblock.co/post/279603/bitcoin-restaking-protocol-bouncebit-funding-tvl"},{"date":"2024-02","event":"BounceBit raises $6 million seed round co-led by Blockchain Capital and Breyer Capital.","source":"PR Newswire","source_url":"https://www.prnewswire.com/news-releases/bouncebit-raises-6m-in-seed-funding-round-to-build-bitcoin-restaking-infrastructure-302075090.html"},{"date":"2024-04","event":"Binance Labs (later YZi Labs) invests in BounceBit; TVL reported above $1 billion.","source":"CryptoBriefing","source_url":"https://cryptobriefing.com/binance-labs-bouncebit-btc-restaking/"},{"date":"2024-07","event":"CVE-2024-39696 publicly disclosed: critical authorization flaw in Evmos fundVestingAccount precompile, patched in Evmos v19.0.0.","source":"GitHub Security Advisory (Evmos)","source_url":"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"},{"date":"2025-02","event":"Reported last update to BounceBit's Evmos chain code, before CVE-2024-39696 patch was incorporated.","source":"Cryip","source_url":"https://cryip.co/bouncebit-shuts-down-its-blockchain-after-exploit-drains-a-quarter-of-bbs-circulating-supply/"},{"date":"2026-05","event":"Evmos project officially discontinued, removing upstream support for the BounceBit chain stack.","source":"The Block / AMBCrypto","source_url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/"},{"date":"2026-08-19","event":"Exploit begins at 21:02 UTC. Attacker exploits Evmos authorization flaw (CVE-2024-39696 class), beginning to transfer BB tokens from nine mainnet accounts. Snapshot block 20,697,260 timestamped 21:02:35 UTC — the pre-exploit cutoff for migration.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"},{"date":"2026-08-20","event":"Final unauthorized transfer occurs at 01:54 UTC. BounceBit halts block production at block height 20,702,857 at 02:36 UTC, approximately 42 minutes later. Total tokens moved: 286,543,148 BB across 14 transactions from nine accounts.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"},{"date":"2026-08-21","event":"BounceBit publicly announces permanent retirement of the Layer 1 blockchain and plans to reissue BB as a BEP-20 token on BNB Chain using the pre-exploit snapshot.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485"},{"date":"2026-08-22","event":"BounceBit discloses migration details: addresses holding 10+ BB auto-distributed; sub-10 BB reserved for claim portal; staked and unbonding balances included. BEP-20 contract address withheld pending exchange due diligence.","source":"CryptoSlate","source_url":"https://cryptoslate.com/bouncebit-abandons-layer-1-after-286-million-token-exploit-leaving-token-holders-in-limbo/"},{"date":"2026-08-24","event":"Reporting places BounceBit within a broader August 2026 exploit wave including Maya Protocol, The Sandbox, and Term Labs, collectively draining approximately $15 million in one week.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/24/crypto-hacks-drain-15m-in-a-week-as-maya-bouncebit-sandbox-and-term-labs-fall/"}],"sources_used":[{"url":"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c","name":"CVE-2024-39696: Evmos fundVestingAccount precompile authorization flaw — GitHub Security Advisory","type":"other","archive_url":null,"credibility":1,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/279603/bitcoin-restaking-protocol-bouncebit-funding-tvl","name":"Bitcoin restaking protocol BounceBit raises $6 million in seed funding — The Block","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485","name":"BounceBit to sunset blockchain, migrate to BNB Chain after $3 million exploit — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260822144013/https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485","credibility":2,"archive_timestamp":"2026-08-22T14:40:13+00:00"},{"url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/","name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","archive_url":"http://web.archive.org/web/20260825004442/https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/","credibility":2,"archive_timestamp":"2026-08-25T00:44:42+00:00"},{"url":"https://cryptoslate.com/bouncebit-abandons-layer-1-after-286-million-token-exploit-leaving-token-holders-in-limbo/","name":"Chain shutdown strips BounceBit token utility after authorization flaw — CryptoSlate","type":"news_article","archive_url":"http://web.archive.org/web/20260825072950/https://cryptoslate.com/bouncebit-abandons-layer-1-after-286-million-token-exploit-leaving-token-holders-in-limbo/","credibility":2,"archive_timestamp":"2026-08-25T07:29:50+00:00"},{"url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/","name":"BounceBit shuts down chain after 286M BB exploit — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260821202829/https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/","credibility":2,"archive_timestamp":"2026-08-21T20:28:29+00:00"},{"url":"https://www.cryptotimes.io/2026/08/24/crypto-hacks-drain-15m-in-a-week-as-maya-bouncebit-sandbox-and-term-labs-fall/","name":"Crypto Hacks Drain $15M in a Week as Maya, BounceBit, Sandbox and Term Labs Fall — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260824181713/https://www.cryptotimes.io/2026/08/24/crypto-hacks-drain-15m-in-a-week-as-maya-bouncebit-sandbox-and-term-labs-fall/","credibility":2,"archive_timestamp":"2026-08-24T18:17:13+00:00"},{"url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/","name":"BounceBit abandons its Layer 1 after 286.5M BB exploit — AMBCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20260824135245/https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/","credibility":2,"archive_timestamp":"2026-08-24T13:52:45+00:00"},{"url":"https://pro.edgex.exchange/news/article/bouncebit-shuts-down-chain-after-bb-token-exploit","name":"BounceBit shuts down layer 1 after authorization exploit, will reissue BB on BNB Chain — EdgeX","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://cryptonews.net/news/security/33331676/","name":"YZi Labs-Backed BounceBit to Shut Down L1 After 286.5M BB Exploit — CryptoNews","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto-economy.com/bouncebit-shuts-down-blockchain-after-3m-exploit-moves-to-bnb-chain/","name":"BounceBit shuts down blockchain after $3M exploit — Crypto Economy","type":"news_article","archive_url":"https://web.archive.org/web/20260828003105/https://crypto-economy.com/bouncebit-shuts-down-blockchain-after-3m-exploit-moves-to-bnb-chain/","credibility":2,"archive_timestamp":"2026-08-28T00:31:05+00:00"},{"url":"https://cryptorank.io/news/feed/60ed5-bouncebit-shuts-down-l1-after-3m-exploit-putting-bb-traders-on-alert","name":"BounceBit shuts down L1 after $3M exploit — CryptoRank","type":"news_article","archive_url":"http://web.archive.org/web/20260828003423/https://cryptorank.io/news/feed/60ed5-bouncebit-shuts-down-l1-after-3m-exploit-putting-bb-traders-on-alert","credibility":2,"archive_timestamp":"2026-08-28T00:34:23+00:00"},{"url":"https://cryip.co/bouncebit-shuts-down-its-blockchain-after-exploit-drains-a-quarter-of-bbs-circulating-supply/","name":"BounceBit shuts down its blockchain after exploit drains a quarter of BB's circulating supply — Cryip","type":"news_article","archive_url":"http://web.archive.org/web/20260822002037/https://cryip.co/bouncebit-shuts-down-its-blockchain-after-exploit-drains-a-quarter-of-bbs-circulating-supply/","credibility":3,"archive_timestamp":"2026-08-22T00:20:37+00:00"},{"url":"https://cryptobriefing.com/binance-labs-bouncebit-btc-restaking/","name":"Binance Labs invests in Bitcoin restaking protocol BounceBit — CryptoBriefing","type":"news_article","archive_url":"http://web.archive.org/web/20260121095405/https://cryptobriefing.com/binance-labs-bouncebit-btc-restaking/","credibility":2,"archive_timestamp":"2026-01-21T09:54:05+00:00"},{"url":"https://www.prnewswire.com/news-releases/bouncebit-raises-6m-in-seed-funding-round-to-build-bitcoin-restaking-infrastructure-302075090.html","name":"BounceBit raises $6M seed round — PR Newswire","type":"official","archive_url":"https://web.archive.org/web/20260828024927/https://www.prnewswire.com/news-releases/bouncebit-raises-6m-in-seed-funding-round-to-build-bitcoin-restaking-infrastructure-302075090.html","credibility":1,"archive_timestamp":"2026-08-28T02:49:27+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-08-27T23:20:40.701158+00:00","updated_at":"2026-08-28T02:49:47.914258+00:00"}}