Decentralized exchange Bunni halts contracts after $2.4M hack
Decentralized exchange Bunni has suffered a security breach that drained approximately $2.4 million in stablecoins.
According to onchain data, the stolen funds included $1.33 million in USDC and $1.04 million in USDT, with the attack specifically targeting its Ethereum-based smart contracts, reports Cointelegraph.
In response, the Bunni team paused all contract functions across supported networks and urged users to withdraw remaining funds. A core contributor, @Psaul26ix, directly warned on X that users should “remove it ASAP,” stressing the urgency of securing assets. While Bunni has yet to release a detailed post-mortem, the exploit highlights vulnerabilities even in well-established DeFi protocols. The hack adds to a growing trend of targeted attacks in 2025 as DeFi adoption surges but security lags behind innovation.
How attackers exploited Bunni’s Liquidity Distribution Function
Initial analysis suggests the exploit was tied to Bunni’s Liquidity Distribution Function (LDF), a custom feature built on Uniswap v4 designed to optimize returns for liquidity providers. Unlike Uniswap’s default mechanics, LDF reallocates liquidity across price ranges to maximize efficiency. However, attackers discovered they could manipulate the curve by making trades of specific sizes, forcing faulty rebalancing calculations. This loophole gave them the ability to gradually drain pool funds while avoiding immediate detection.
According to Victor Tran, co-founder of KyberNetwork, the vulnerability stemmed from the system’s sensitivity to precise trade inputs. The exploit demonstrates how small deviations from proven models like Uniswap can introduce systemic weaknesses. Developers now face growing pressure to balance innovation with rigorous stress-testing of new mechanisms.
Crypto hacks rise as attackers evolve tactics
The Bunni exploit fits into a wider pattern of rising crypto hacks, with August alone seeing $163 million stolen across 16 incidents. This marks a 15% increase compared to July, though still down 47% year-over-year, showing that exploit activity spikes when crypto markets gain momentum. Notably, August’s largest single loss came from a $91 million social engineering scam, where a Bitcoiner was tricked by attackers posing as support staff.
Analysts have also flagged a shift toward targeting centralized exchanges and high-value individuals, while DeFi protocols remain susceptible to smart contract manipulation. Despite improved auditing standards, hackers continue to exploit overlooked design flaws or complex composability risks. For Bunni, the incident may serve as a cautionary lesson for other protocols adopting custom liquidity logic without robust security reviews.
Recently we wrote that CoinDCX, one of India’s largest cryptocurrency exchanges, confirmed a $44 million hack but assured users that their funds remain safe and unaffected. The company pledged to fully cover the losses from its treasury reserves.
Latest Crypto News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
