Bunni DEX Shutdown Confirmed After Devastating $8.4M September Exploit
Another DeFi protocol bites the dust—Bunni DEX officially pulls the plug following catastrophic security breach.
The $8.4 Million Drain
September's exploit proved fatal, stripping $8.4 million from the decentralized exchange's liquidity pools. Smart contract vulnerabilities left the platform bleeding funds—no emergency stop mechanism could save it.
DeFi's Persistent Security Crisis
Bunni joins the growing graveyard of DeFi projects undone by code exploits. Despite blockchain's promise of trustless systems, human coding errors continue creating million-dollar opportunities for hackers.
Investors left holding empty bags while the team announces shutdown—just another day in the wild west of decentralized finance where 'code is law' until it isn't.
Hack leaves project unable to recover
The attack, which targeted Bunni’s primary ethereum (ETH) and Unichain smart contracts, took place in early September. Attackers exploited a vulnerability in the project’s Liquidity Distribution Function, a feature designed to optimize liquidity provider returns, allowing them to withdraw more assets than entitled through flash loan manipulation and rounding errors.
Roughly $8.4 million was drained, mostly in USDC and USDT, before the team froze contract operations. A 10% bounty was offered to recover the funds, but the attacker never responded. Despite earlier audits by Trail of Bits and Cyfrin, the bug was classified as a “logic-level flaw” rather than an implementation error.
Since the hack, Bunni’s total value locked has dropped from over $60 million to NEAR zero, with trading and development activity grinding to a halt.
Open-source farewell and user compensation plan
In its shutdown statement, the Bunni team said it WOULD have required “six to seven figures” in audit and monitoring costs, plus months of redevelopment, to safely resume operations, an expense it could not meet.
Users will still be able to withdraw funds through the Bunni website until further notice. Remaining treasury assets will be distributed to BUNNI, LIT, and veBUNNI holders based on a snapshot once the legal process concludes. Team members will be excluded from the distribution.
As a final move, Bunni relicensed its v2 smart contracts from BUSL to MIT, making its technologies, including LDFs, surge fees, and autonomous rebalancing, freely available to other developers. The team said it continues to work with law enforcement to recover stolen funds.
The shutdown adds to a difficult year for blockchain security, with over $3.1 billion lost in hacks and exploits so far in 2025.
