Decentralized exchange protocol Bunni has officially announced its shutdown after experiencing an $8.4 million exploit last month.
This marks the second crypto project to halt operations in October, following the Kadena Organization, which also decided to step back from its project amid ongoing challenges.
Sponsored
Sponsored
The Bunni Hack: What Happened?
On September 2, an attacker stole $8.4 million from the Bunni exchange. In a detailed post-mortem report, the platform explained that the hacker exploited a rounding-direction bug in the smart contract’s withdrawal logic, using a combination of flashloans, micro-withdrawals, and sandwich attacks.
The vulnerability allowed the attacker to artificially reduce and inflate the pool’s total liquidity, extracting profits from manipulated swaps. Bunni noted that two pools — weETH/ETH on Unichain and USDC/USDT on Ethereum — were affected. However, the largest pool, Unichain USDC/USD₮0, escaped exploitation due to insufficient flashloan liquidity.
DefiLlama data showed that after the hack, Bunni’s Total Value Locked (TVL) declined from $50.82 million to just $1.3 million in a month, marking a drop of 97.44%.
Bunni’s TVL Before and After The Hack. Source: DefiLlamaSponsored
Sponsored
$8.4 Million Exploit Forces DEX to Halt Operations
Despite multiple attempts to recover from the incident, including a proposal to let the attacker keep 10% of the stolen funds if the rest was returned, the attempts proved unsuccessful.
In a recent update, Bunni announced its decision to wind down operations, citing the heavy strain caused by the exploit. The team noted that relaunching would require comprehensive audits and constant monitoring, with estimated costs running hundreds of thousands to millions of dollars, which exceeded available capital.
Bunni notified its users that they can withdraw funds through the website. Furthermore, based on a snapshot, the team plans to distribute the remaining treasury assets to BUNNI, LIT, and veBUNNI holders, excluding the team members.
The distribution details will be released after the legal processes are completed. Meanwhile, the team is cooperating with law enforcement in attempts to recover the stolen funds.
Crypto platforms and exchanges face mounting threats, with incidents like Bunni’s emphasizing the need for strong security. The industry lost $127.06 million in September, with 20 large-scale attacks recorded.
Besides security reasons, volatile market conditions have also forced platforms to leave the market. Yesterday, the Kadena organization ceased all business operations, leaving the Kadena blockchain to independent miners.
Source: https://beincrypto.com/bunni-shutdown-defi-hack/
