BlockBeats News, August 21st. Cross-chain yield protocol BounceBit released a security incident announcement stating that its blockchain network experienced a protocol-level exploit on August 19th from 21:02 UTC to August 20th 01:54 UTC. The attacker exploited an authorization flaw in the Evmos underlying architecture to transfer BB tokens from 9 mainnet accounts without the account owners' consent.

According to the announcement, the attacker transferred approximately 286.5 million BB tokens through a total of 14 transactions. The impact of the incident was limited to the BounceBit Chain itself and did not involve private key leaks, signature forgery, wallet, hardware device, or exchange account security issues. BounceBit's CeDeFi Strategy, Promo Vaults, Prime, and RWA products were unaffected.

BounceBit stated that the vulnerability stemmed from an authorization validation flaw in a protocol native module within the Evmos architecture. When the attacker invoked the relevant module through a smart contract, they bypassed the security check that should have verified the authorization relationship of the funding source account, allowing them to designate any account as the funding source.

Following the incident, BounceBit Chain halted block production at block height 20,702,857. Subsequently, the team decided not to perform a chain upgrade but to permanently shut down the BounceBit Chain and reissue BB as a BEP-20 token on the BNB Chain.

BounceBit mentioned that the supply of the new BB tokens would be based on an on-chain snapshot taken before the initial abnormal transfer (block height 20,697,260), with the 286,543,148 BB tokens transferred by the attacker not included in the new token balance. Users are not required to submit applications or migrate wallets, as the team plans to automatically distribute the new BB tokens to the corresponding BNB Chain addresses.