The decentralized finance (DeFi) minefield claimed its newest sufferer this morning as Bunni, an alternate constructed on prime of Uniswap, was exploited for a reported $8.4 million.
In accordance with the Bunni web site, the app “maximizes liquidity provider profits in all market conditions.” Right now’s losses recommend in any other case.
Roughly two hours after crypto safety audit agency BlockSec raised the alarm over the suspicious transactions, the Bunni crew acknowledged the incident and paused its contracts throughout all networks.
🚨 The Bunni app has been affected by a safety exploit. As a precaution, we’ve got paused all sensible contract capabilities on all networks. Our crew is actively investigating and can present updates quickly. Thanks in your persistence.
— Bunni (@bunni_xyz) September 2, 2025
BlockSec had initially flagged losses of round $2.3 million on Ethereum however, when extra audit companies regarded into the incident, the entire shortly grew on different networks.
Hacken recognized an additional $6 million on Unichain, Uniswap’s personal community, bringing the entire to $8.4 million.
The stolen funds stay in two addresses, which include the proceeds from the assaults on Ethereum and Unichain, respectively.
Bunni assault all about precision
The exploit seems to be associated to a precision bug within the platform’s “liquidity distribution function” curve, in accordance with KyberSwap CEO and co-founder Victor Tran’s evaluation.
The bug allowed the hacker to “manipulate this LDF by making trades of very specific sizes.”
The trades “caused the rebalancing calculation to break, giving wrong results for how much each [liquidity provider] share should own.”
The hacker repeated the method, withdrawing extra LP tokens and draining Bunni’s liquidity swimming pools.
Helpfully, for these deciphering the reason for the exploit, the hacker had left over 1,000 logs of occasions throughout the assault transaction, with feedback akin to “Depositing to euler” and “Unlock Callback.”
Bunni’s codebase had been audited by well-respected safety companies together with Path of Bits and Cyfrin, with “critical” findings in lots of the stories.
On the time of writing, it stays unclear whether or not at the moment’s exploit falls beneath the scope of those audit stories.
In response to the hack, Euler’s co-founder Michael Bentley was eager to level out that “Bunni rebalances funds in/out of Euler but Euler is not affected or at risk.”
The $1.5 billion DeFi lending big was itself hacked in March 2023 for round $200 million, its whole holdings on the time.
