Malicious actors in the cryptocurrency space remain a constant threat to the sector and are not moved by market conditions as they strike during bull and bearish market conditions. Within the last 24 hours, Uniswap V4’s Bunni decentralized exchange (DEX) has been attacked by hackers.

Hackers exploit Bunni DEX vulnerability

According to an update from PeckShieldAlert, a blockchain security firm that monitors the crypto space, hackers have exploited a vulnerability on Bunni DEX. This has led to the hackers stealing approximately $2.4 million worth of assets.

You Might Also Like

Critical details of who the attackers could be and the different crypto assets stolen have not been revealed. However, the theft, occurring in the midst of an ongoing bull market, is poised to affect investors who use the exchange.

As of press time, a message from Bunni on their official X handle acknowledged the “security exploit” and precautionary measures taken so far. According to the DEX, their team is currently investigating the incident and will provide details as soon as investigations are concluded.

It has, however, paused all smart contract functions on all networks while this is ongoing. Bunni has called for patience on the part of its users.

Are there security concerns over Uniswap V4 ecosystem?

The compromise on Bunni DEX by these hackers reemphasizes the need for exchanges to pay attention to safeguarding funds on their platform. This suggests that malicious actors are always scanning the crypto space and attempting to steal. Failure to secure protocols could lead to loss of funds.

You Might Also Like

Interestingly, in February 2025, Uniswap launched a new V4 protocol that included gas efficiency. Some users have wondered if it has also strengthened its security features to protect exchanges in its ecosystem.

U.Today has consistently reported on scam alerts and activities of hackers with emphasis on how to avoid falling victim to their exploits and safeguarding funds.

A single phishing attack drained nearly $1 million worth of tokens from a crypto investor who unknowingly signed a batch of malicious transactions disguised as Uniswap swaps, according to blockchain security firm Scam Sniffer.

In an Aug. 22 post on X, Yu Xiang, founder of blockchain security firm SlowMist, noted that the incident involved five tokens siphoned through a transaction exploiting Ethereum’s new EIP-7702 mechanism.

He explained:

“From the perspective of a phished user, it goes like this: the user opens a phishing website, a wallet signature prompt pops up, the user clicks confirm, and with just that one action, all valuable assets in the wallet address vanish in a snap.”

EIP-7702 was introduced in the Pectra upgrade to streamline the Ethereum user experience. The feature allows a wallet to act like a temporary smart contract, making it possible to batch multiple transactions, enable gas sponsorship, or set spending limits in one step.

In principle, the delegation is revocable and network-specific. However, attackers have found ways to weaponize the feature in practice.

Crypto market maker Wintermute has warned that the standard’s implementation is being exploited at scale. Its June analysis showed that more than 90% of EIP-7702 delegations were linked to malicious contracts.

The firm pointed out that many of these contracts are simple copy-paste scripts that scan for vulnerable wallets and drain their holdings automatically.

Considering this, Scam Sniffer and Xiang urged crypto users to take extra care before signing wallet requests. They recommended verifying domain names, avoiding rushed confirmations, and rejecting signatures that seem unclear or overly broad.

They also stated that some of the red flags that could arise include requests for unlimited token approvals, contract upgrades under EIP-7702, or transaction simulations that do not match expectations.

Mentioned in this article

The investigation points to $71.9 million taken from 1,539 victims through a mix of storefront operations, fraudulent claims, and cash collection machines.

Prosecutors requested the seizure of NT$1.275 billion (about $39.8 million), along with 640,000 USDT
USDT


$0.9883

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is NEO in Crypto? Chinese Ethereum Explained (ANIMATED)

About $3.13 million in bank deposits has already been frozen, with more recoveries expected.

According to investigators, the accused collected money in cash, converted it into foreign currency, and used it to purchase USDT through BiXiang Technology, a local exchange.

The main suspect, Shi Qiren, was arrested in April together with thirteen associates. Reports indicate Shi could face up to 25 years in prison for leading the operation and for refusing to plead guilty. Prosecutors alleged that starting in 2024, Shi, his wife, and a business partner named Yang opened forty outlets under the names “CoinW” and “CoinThink Technology Co., Ltd”.

Officials claimed the group pretended to be the only company approved by Taiwan’s Financial Supervisory Commission, which helped them attract more than 1,500 customers. By combining franchise fees and machine collections, they allegedly gathered nearly $72 million.

On August 11, police in Phú Thọ Province, Vietnam, shut down the largest cryptocurrency scam recorded in the country. How? Read the full story.