Bunni – Earlybirds Invest

A recent exploit has forced decentralized exchange Bunni to pause its smart contracts after a vulnerability allowed an attacker to take around $2.4 million in stablecoins.

Security researchers reviewing blockchain records confirmed that the loss occurred due to a flaw in how Bunni calculates liquidity distribution.

The incident was confirmed by the Bunni team on X on September 2, where they announced the shutdown of all smart contract activity across supported blockchains while the situation is under review.

Is Your Crypto Safe? (5 Best Crypto Security Practices Explained)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

Funds were drained from Bunni’s Ethereum
ETH

$4,289.92

contracts and moved into a single wallet. This wallet currently holds around $1.33 million in USDC
USDC

$0.9996

and another $1.04 million in USDT
USDT

$0.9992

.

Following the event, Bunni contributor @Psaul26ix urged users to exit the platform immediately and warned them to remove any remaining assets from its pools.

Bunni relies on Euler Finance to manage its lending and structured product offerings. Despite the connection, Euler’s CEO, Michael Bentley, made it clear that Euler’s own protocol was not impacted.

<br />

Instead of using the default Uniswap
UNI

$9.43

logic, Bunni uses its own Liquidity Distribution Function (LDF), designed to spread liquidity across different price levels to help providers earn better returns. However, this function appears to have been at the core of the issue.

Victor Tran, the co-founder of KyberNetwork, explained that the attacker had discovered a way to trick the system by making trades of exact sizes, which caused errors in the liquidity rebalancing process.

<br />

On September 1, attackers exploited a security flaw to steal WLFI tokens from Ethereum ETH wallets. How? Read the full story.

Hackers exploit Bunni DEX vulnerability

According to an update from PeckShieldAlert, a blockchain security firm that monitors the crypto space, hackers have exploited a vulnerability on Bunni DEX. This has led to the hackers stealing approximately $2.4 million worth of assets.

You Might Also Like

Critical details of who the attackers could be and the different crypto assets stolen have not been revealed. However, the theft, occurring in the midst of an ongoing bull market, is poised to affect investors who use the exchange.

As of press time, a message from Bunni on their official X handle acknowledged the “security exploit” and precautionary measures taken so far. According to the DEX, their team is currently investigating the incident and will provide details as soon as investigations are concluded.

The Bunni app has been affected by a security exploit. As a precaution, we have paused all smart contract functions on all networks. Our team is actively investigating and will provide updates soon. Thank you for your patience.

— Bunni (@bunni_xyz) September 2, 2025

It has, however, paused all smart contract functions on all networks while this is ongoing. Bunni has called for patience on the part of its users.

Are there security concerns over Uniswap V4 ecosystem?

The compromise on Bunni DEX by these hackers reemphasizes the need for exchanges to pay attention to safeguarding funds on their platform. This suggests that malicious actors are always scanning the crypto space and attempting to steal. Failure to secure protocols could lead to loss of funds.