BounceBit Chain Shuts Down After Evmos Authorization Bypass Drains $3M in BB Tokens

Root Cause

BounceBit Chain was built on the Evmos technology stack, which bridges the Ethereum Virtual Machine with the Cosmos SDK. A vulnerability in the Evmos EVM module permitted a smart contract to specify a different account as the from address (the transaction originator) in MsgEthereumTx without requiring cryptographic proof that the designated account authorized the transaction.

This is analogous to a tx.origin or msg.sender spoofing vulnerability at the chain level rather than at the contract level — no private key was compromised, no signature was forged, yet the chain's own execution environment accepted transfers that the account owners never signed:

// Conceptual representation — the flaw was in the Evmos chain's
// MsgEthereumTx handler, not in a user-deployed contract
// A malicious contract could effectively do:
function drainAccount(address victim, uint256 amount) external {
    // Evmos's EVM module accepted `from = victim` without
    // requiring victim's signature on the underlying Cosmos tx
    IERC20(BB_TOKEN).transferFrom(victim, attacker, amount);
    // transferFrom succeeded because the chain-level sender spoofing
    // bypassed the ERC-20 allowance check
}

Evmos was officially discontinued in May 2026, leaving no upstream maintainer to patch the vulnerability. Any protocol built on Evmos at the time of shutdown inherited an unpatched attack surface with no upgrade path.

Attack Steps

Impact

• Estimated loss: ≈$3 million (286.5M BB tokens ≈ 25% of circulating supply)
• Chain: BounceBit Chain (Evmos-based EVM-compatible L1)
• Accounts affected: 9 mainnet accounts
• No private keys or signatures compromised
• Protocol response: L1 permanently retired; BB token reissued as BEP-20 on BNB Chain using pre-attack snapshot; unauthorized transfers reversed via snapshot rollback

Lessons for Auditors

1. Inherited chain-level vulnerabilities: Protocols and chains built on third-party EVM stacks (Evmos, Berachain forks, custom Cosmos-EVM bridges) inherit all vulnerabilities of the underlying stack. Auditing the application layer is insufficient — the entire EVM ↔ Cosmos bridge logic must be reviewed.
2. Discontinued upstream is a critical risk: Building on actively maintained infrastructure is a security property. When an upstream dependency (Evmos, in this case) is discontinued, all protocols relying on it face an unpatched, deteriorating security posture. Auditors should flag end-of-life dependencies as high/critical findings.
3. Chain-level sender spoofing: Any EVM environment that processes transactions through an intermediate message layer (Cosmos SDK, rollup sequencer, etc.) must verify that the EVM from field matches the cryptographic signer of the outer transaction. This should be verified in architecture reviews, not just contract-level audits.
4. Snapshot-based recovery: BounceBit's recovery via pre-attack snapshot (re-issuing tokens on a new chain using historical state) is a viable but disruptive disaster-recovery mechanism. Protocols should have snapshot/recovery runbooks prepared before an exploit occurs.