Audit log

Every state-changing event for BounceBit: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-24 12:04:23Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   5VLqdAdyfAxb…PZ2R8Pxicopysha256 → base58

   verifying row…

   canonical bytes (19801 B) ▸

   {"actor":"system:backfill","investigation_id":"b029d553-f9b3-4290-8dfb-d8db25d5d52b","kind":"publish","page_slug":"bouncebit","published_at":"2026-08-24T12:04:23.717Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BounceBit","sections":[{"content":"Between 21:02 UTC on August 19, 2026, and 01:54 UTC on August 20, 2026, an attacker moved 286,543,148 BB tokens — then valued at approximately $3 million — across 14 transactions originating from nine mainnet accounts. BounceBit halted block production at 02:36:37 UTC on August 20, approximately 42 minutes after the final unauthorized transfer. The incident lasted roughly four hours and 52 minutes in total. According to BounceBit's post-mortem, no private keys were stolen, no signatures were forged, and no user wallets, hardware devices, or exchange accounts were compromised. The attack surface was entirely internal to the protocol's own authorization logic. The attacker distributed the proceeds as follows: approximately 254 million BB were sent to one major centralized exchange, nearly 10 million BB to a second exchange, and approximately 18.5 million BB remained in a consolidated attacker-controlled address. BounceBit subsequently requested that affected exchanges freeze relevant deposits, specifying that freeze requests were limited to clearly linked addresses and did not extend to commingled funds containing unrelated third-party assets.","heading":"August 2026 Authorization Exploit","severity":"critical","sources":[{"credibility":2,"name":"BounceBit to sunset blockchain, migrate to BNB Chain after $3 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485"},{"credibility":2,"name":"BounceBit Shuts Down Chain After 286M BB Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"},{"credibility":2,"name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/"},{"credibility":2,"name":"BounceBit Retires Its Chain After Attacker Moves 286.5 Million Tokens — BeInCrypto","type":"news_article","url":"https://beincrypto.com/bouncebit-exploit-chain-sunset-bb-reissue/"}]},{"content":"BounceBit Chain was built on the Evmos stack, an EVM-compatible framework originally developed for the Cosmos ecosystem. The Evmos stack included a built-in vesting and lockup account module that allowed a designated funder account to provide tokens for a vesting plan tied to another account. The vulnerability resided in how this module's authorization was enforced along the smart-contract call path. When a smart contract invoked the vesting module, a second permission check — intended to confirm that the debited account had granted authorization to the caller — ran against the wrong principal. As a result, any caller could designate an arbitrary account as the funding source without holding a valid grant from that account. The authorization check never fired correctly along this code path, making the flaw exploitable by any party with knowledge of the module's interface. The exploit did not require access to private keys or any off-chain credential; it was a protocol logic failure. BounceBit described the root cause as a flaw in a 'built-in protocol functionality provided by the Evmos stack' in its official communications. The Evmos network itself had ceased operations in May 2026, following the passage of governance Proposal #331 ('Evmos Shutdown') with 99.8% of votes in favor, after which block production halted at block height 37,318,000.","heading":"Technical Root Cause: Evmos Vesting Account Module","severity":"critical","sources":[{"credibility":2,"name":"BounceBit Shuts Down Chain After 286M BB Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"},{"credibility":2,"name":"BounceBit abandons its Layer 1 after 286.5M BB exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/"},{"credibility":2,"name":"Evmos Ceases Operations After Shutdown Proposal — Phemex News","type":"news_article","url":"https://phemex.com/news/article/evmos-halts-operations-following-shutdown-proposal-approval-85093"},{"credibility":2,"name":"Cosmos EVM Chain Evmos Network officially shut down — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cosmos-evm-chain-evmos-network-officially-shut-down-website-and-infrastructure-unavailable"}]},{"content":"Following the exploit, BounceBit announced the permanent shutdown of BounceBit Chain and a migration of the BB token to BNB Chain as a BEP-20 asset. The team stated that patching the vulnerability and restarting the chain was not a viable path, explaining that 'moving our fork onto a successor codebase would therefore not be a conventional upgrade, but a substantial re-platform requiring a full rebuild, re-audit, and revalidation before it could safely carry user assets again.' Because the Evmos framework had been discontinued in May 2026, there was no supported upstream codebase to upgrade to. Balances for the token reissuance will be determined by the chain state at block 20,697,260, captured at 21:02:35 UTC on August 19, 2026 — the last confirmed block before the first unauthorized transfer. All transactions recorded during the attack window will be reversed. Staked and unbonding positions as of the snapshot block will be included. BounceBit stated that holders will receive reissued BB automatically on BNB Chain and that no action is required from token holders. The team also warned the public that there is 'currently no claim site or claim form' for the new tokens, cautioning users against signing transactions with unverified claim websites — a common post-exploit phishing vector. BNB Chain was selected on the basis of wider wallet support, deeper liquidity, and a larger developer and user base. BounceBit noted that many of its existing products already operated on BNB Chain, where user activity was concentrated.","heading":"Chain Shutdown and Migration to BNB Chain","severity":"high","sources":[{"credibility":2,"name":"BounceBit to sunset blockchain, migrate to BNB Chain after $3 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485"},{"credibility":2,"name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/"},{"credibility":2,"name":"BounceBit abandons its Layer 1 after 286.5M BB exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/"},{"credibility":2,"name":"BounceBit Shuts Down Chain After 286M BB Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"}]},{"content":"BounceBit was founded as a Bitcoin restaking and CeDeFi (centralized-decentralized finance) infrastructure platform, positioning itself as a Layer 1 chain secured by validators staking both BTC and its native BB token — a dual-token proof-of-stake model with full EVM compatibility. The project raised $6 million in a seed funding round co-led by Blockchain Capital and Breyer Capital. Additional investors included CMS Holdings, OKX Ventures, and NGC Ventures. Angel participants included Nathan McCauley (co-founder and CEO of Anchorage Digital), Ashwin Aiyappan (portfolio manager at Brevan Howard), and Calvin Liu (Chief Strategy Officer of EigenLayer). In April 2024, YZi Labs (then operating as Binance Labs) announced an investment in BounceBit, describing the project as building 'BTC restaking CeDeFi infrastructure.' BounceBit launched its mainnet on May 13, 2024, concurrent with the listing of BB tokens on Binance. The token was distributed in part through Binance's inaugural Megadrop event. Prior to mainnet, the project ran a TVL growth initiative called the Water Margin Event, which the team reported attracted approximately $1 billion in Total Value Locked (TVL) and nearly 400,000 early contributors. No regulatory actions, prior security incidents, or fraud allegations have been identified in available sources prior to the August 2026 exploit.","heading":"Background and Funding","severity":"low","sources":[{"credibility":2,"name":"YZi Labs on X — investment announcement","type":"social_media","url":"https://x.com/BinanceLabs/status/1778348082532667771"},{"credibility":2,"name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/"},{"credibility":2,"name":"BounceBit mainnet and BB token launch — CryptoNomist","type":"news_article","url":"https://en.cryptonomist.ch/2024/05/08/bouncebit-mainnet-and-bb-token-launch-scheduled-for-may-13-heres-everything-you-need-to-know/"},{"credibility":2,"name":"BounceBit(BB) New Listing on Binance at May 13 2024 — CoinCarp","type":"news_article","url":"https://www.coincarp.com/events/bouncebit-new-listing-on-binance/"}]},{"content":"The BB token reached a record low of approximately $0.0079 on August 20, 2026, the day following the exploit, before recovering somewhat to approximately $0.0111 (up roughly 16% in 24 hours) as the migration plan became known, according to available price data. The token had been trading substantially below its 2024 listing price prior to the exploit. Token holders who held BB at block 20,697,260 on August 19, 2026, are expected to receive reissued BEP-20 BB tokens on BNB Chain without needing to take any action. Holders who acquired BB after the snapshot cutoff but before the chain halt may face complications. Transactions occurring during the attack window will be reversed, which could affect any users who transacted during that approximately five-hour period. BounceBit requested that exchanges freeze funds linked to specific attacker addresses; the project was careful to limit these requests to clearly attacker-linked deposits and explicitly stated they did not request broad freezes that would affect commingled third-party funds. Separately, BounceBit warned users to avoid unverified websites claiming to offer BB token claim portals, as these are common phishing vectors in the wake of high-profile exploits. The extent to which the stolen 286.5 million BB tokens were recovered or frozen at exchanges had not been confirmed in publicly available sources as of the time of this investigation.","heading":"Community and User Impact","severity":"high","sources":[{"credibility":2,"name":"BounceBit Retires Layer 1 Chain After Attacker Moves 286.5M BB Tokens — COINOTAG","type":"news_article","url":"https://en.coinotag.com/bouncebit-retires-layer-1-chain-after-attacker-moves-2865m-bb-tokens"},{"credibility":2,"name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/"},{"credibility":2,"name":"BounceBit Shuts Down Chain After 286M BB Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"}]},{"content":"A contributing factor to the severity of BounceBit's response was the underlying architectural decision to build on the Evmos stack. Evmos formally ceased operations in May 2026 after its governance approved a shutdown proposal with near-unanimity (99.8% of votes in favor). Block production on the Evmos network halted at block 37,318,000. At the time of the August 2026 exploit, BounceBit was operating a fork of infrastructure that had no active upstream maintainer. When the vesting module vulnerability was identified, the team concluded that patching and continuing the chain was not feasible: the fork could not simply be upgraded to a patched version, and migrating to a successor EVM framework — such as Cosmos EVM, which absorbed some of the Evmos codebase — would constitute a full rebuild requiring new audits, new validator onboarding, and extensive testing before it could be trusted with user funds. This dependency on end-of-life infrastructure is a material infrastructure risk factor that predated the exploit and contributed directly to the chain's permanent shutdown rather than a temporary halt and recovery.","heading":"Infrastructure Risk: Dependency on Discontinued Framework","severity":"high","sources":[{"credibility":2,"name":"Evmos Ceases Operations After Shutdown Proposal — Phemex News","type":"news_article","url":"https://phemex.com/news/article/evmos-halts-operations-following-shutdown-proposal-approval-85093"},{"credibility":2,"name":"Cosmos Ecosystem Faces Shutdown Wave in 2025 — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605064306"},{"credibility":2,"name":"BounceBit abandons its Layer 1 after 286.5M BB exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/"}]}],"sources_used":[{"credibility":2,"name":"BounceBit to sunset blockchain, migrate to BNB Chain after $3 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485"},{"credibility":2,"name":"YZi Labs-backed BounceBit Chain shuts down after $3M exploit — Protos","type":"news_article","url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/"},{"credibility":2,"name":"BounceBit Shuts Down Chain After 286M BB Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"},{"credibility":2,"name":"BounceBit abandons its Layer 1 after 286.5M BB exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/bouncebit-abandons-its-layer-1-after-286-5m-bb-exploit-why-bnb-chain/"},{"credibility":2,"name":"BounceBit Retires Layer 1 Chain After Attacker Moves 286.5M BB Tokens — COINOTAG","type":"news_article","url":"https://en.coinotag.com/bouncebit-retires-layer-1-chain-after-attacker-moves-2865m-bb-tokens"},{"credibility":2,"name":"BounceBit Retires Its Chain After Attacker Moves 286.5 Million Tokens — BeInCrypto","type":"news_article","url":"https://beincrypto.com/bouncebit-exploit-chain-sunset-bb-reissue/"},{"credibility":2,"name":"Bitcoin Restaking Platform BounceBit To Wind Down L1 Blockchain — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/300073-bitcoin-restaking-platform-bouncebit-to-wind-down-l1-blockchain-following-exploit/"},{"credibility":2,"name":"BounceBit Chain Shutdown Confirmed: BB Migrates to BNB Chain — CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/bouncebit-chain-shutdown-confirmed-bb-migrates-to-bnb-chain"},{"credibility":2,"name":"Evmos Ceases Operations After Shutdown Proposal — Phemex News","type":"news_article","url":"https://phemex.com/news/article/evmos-halts-operations-following-shutdown-proposal-approval-85093"},{"credibility":2,"name":"Cosmos EVM Chain Evmos Network officially shut down — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cosmos-evm-chain-evmos-network-officially-shut-down-website-and-infrastructure-unavailable"},{"credibility":2,"name":"YZi Labs investment announcement on X","type":"social_media","url":"https://x.com/BinanceLabs/status/1778348082532667771"},{"credibility":2,"name":"BounceBit mainnet and BB token launch — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2024/05/08/bouncebit-mainnet-and-bb-token-launch-scheduled-for-may-13-heres-everything-you-need-to-know/"},{"credibility":2,"name":"BounceBit(BB) New Listing on Binance May 13 2024 — CoinCarp","type":"news_article","url":"https://www.coincarp.com/events/bouncebit-new-listing-on-binance/"},{"credibility":2,"name":"Crypto Hacks Drain $15M in a Week — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/24/crypto-hacks-drain-15m-in-a-week-as-maya-bouncebit-sandbox-and-term-labs-fall/"}],"summary":"BounceBit was a Bitcoin restaking Layer 1 blockchain backed by YZi Labs (formerly Binance Labs) and Blockchain Capital that launched mainnet in May 2024. On August 19-20, 2026, an attacker exploited an authorization flaw in the project's Evmos-based vesting account module to move 286.5 million BB tokens (~$3 million) across 14 transactions without holding valid grants. The protocol's reliance on the discontinued Evmos framework made a rebuild infeasible; BounceBit permanently shut down its chain and announced BB will be reissued as a BEP-20 token on BNB Chain using a pre-attack snapshot.","timeline":[{"date":"2024-04-01","event":"YZi Labs (then Binance Labs) announced an investment in BounceBit, describing the project as building BTC restaking CeDeFi infrastructure.","source":"YZi Labs on X","source_url":"https://x.com/BinanceLabs/status/1778348082532667771"},{"date":"2024-05-13","event":"BounceBit mainnet launched. BB token listed on Binance through the exchange's inaugural Megadrop event. Trading pairs opened in BB/BTC, BB/USDT, BB/BNB, BB/FDUSD, and BB/TRY.","source":"CoinCarp / Cryptonomist","source_url":"https://www.coincarp.com/events/bouncebit-new-listing-on-binance/"},{"date":"2026-05-18","event":"Evmos network officially ceased operations at block height 37,318,000 after governance Proposal #331 passed with 99.8% approval, leaving BounceBit operating on an unmaintained fork.","source":"Phemex News / KuCoin News","source_url":"https://phemex.com/news/article/evmos-halts-operations-following-shutdown-proposal-approval-85093"},{"date":"2026-08-19","event":"At 21:02:35 UTC, the first unauthorized transfer began. An attacker exploited an authorization flaw in BounceBit's Evmos-based vesting account module. Chain state at block 20,697,260 was later designated as the pre-attack snapshot for the BNB Chain reissuance.","source":"CryptoTimes / Protos","source_url":"https://www.cryptotimes.io/2026/08/21/bouncebit-shuts-down-chain-after-286m-bb-exploit/"},{"date":"2026-08-20","event":"At 01:54 UTC, the final unauthorized transfer completed. In total, 286,543,148 BB tokens (~$3 million) were moved from nine accounts across 14 transactions. At 02:36:37 UTC, BounceBit halted block production.","source":"CryptoTimes / Protos / The Block","source_url":"https://protos.com/yzi-labs-backed-bouncebit-chain-shuts-down-after-3m-exploit/"},{"date":"2026-08-20","event":"BB token hit a record low of approximately $0.0079 following the exploit announcement.","source":"COINOTAG","source_url":"https://en.coinotag.com/bouncebit-retires-layer-1-chain-after-attacker-moves-2865m-bb-tokens"},{"date":"2026-08-21","event":"BounceBit announced the permanent shutdown of BounceBit Chain and confirmed BB will be reissued as a BEP-20 token on BNB Chain using balances from the pre-attack snapshot at block 20,697,260. The team cited the discontinued Evmos framework as making a rebuild infeasible.","source":"The Block / Protos / BeInCrypto","source_url":"https://www.theblock.co/news/ecosystems/2026-08-21-bouncebit-sunset-blockchain-migrate-bnb-chain-after-3-million-exploit-412485"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 59a7ee5d-f5bd-4963-b6ad-473ac4482717copy