BounceBit Chain updates vulnerability attack progress: will permanently shut down the chain and migrate to BNB Chain
Comparatively, cross-chain revenue protocol BanceBit issued a security incident announcement stating that its blockchain network was attacked by a protocol-level vulnerability attack between 8:02 UTC on August 19 and 01:54 UTC on August 20. The attackers used authorization flaws in the Evmos underlying architecture to transfer BB tokens from 9 main network accounts without the authorization of the account owners. According to the announcement, the attackers transferred a total of approximately 286.5 million BBs through 14 transactions.
The impact of the incident was limited to BanceBit Chain itself, and did not involve private key leaks, signature forgery, wallet, hardware devices, or exchange account security issues. BanceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products were not affected. BounceBit stated that the vulnerability stemmed from a protocol native module authorization verification flaw in the Evmos architecture. When calling the relevant module through a smart contract, the attackers bypass security checks that should verify the authorization relationship of the fund source account, making it possible to specify any account as the source of funds.
After the incident, BounceBit Chain stopped generating blocks at block height 20,702,857. The team then decided not to upgrade the chain, but to permanently shut down BanceBit Chain and re-issue BB as an BEP-20 token based on BNB Chain. BounceBit stated that the new BB token supply will be based on an on-chain snapshot before the first abnormal transfer (block height 20,697,260), and the 286,543,148 BBs transferred by the attackers will not be included in the new token balance. Users do not need to submit an application or migrate their wallets, and the official plan is to automatically distribute the new BB to the corresponding BNB Chain addresses. Regarding the BB in the pledge, BounceBit said it will be restored as soon as the snapshot is in time, and there is no need for coin holders to perform unbundling or redemption operations. Currently, BounceBit has submitted requests for suspension and assistance to relevant exchanges, and reminds users to be wary of scams and not to click on any BB migration or receipt links that have not been officially confirmed. The team said that the new BEP-20 BB contract address and reissue progress will be announced later.
This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)
