Bunni Decentralized Exchange Hit by $2.4 Million Exploit
Bunni, a decentralized exchange, suffered an exploit leading to the loss of approximately $2.4 million in stablecoins. Attackers manipulated the platform's liquidity calculations, according to analysis from various Web3 security firms.
Incident and Immediate Response
On Tuesday, Bunni confirmed on X (formerly Twitter) that its application had been compromised. As a precaution, all smart contract functions across supported networks were paused. The team encouraged users to withdraw any remaining funds while they investigate the nature of the breach.
Attack Details
The exploit specifically targeted Bunni�s Ethereum-based smart contracts. Onchain data shows that funds were drained into addresses containing approximately $1.33 million in USDC and $1.04 million in USDt. The incident prompted a core contributor to issue an urgent call for users to remove assets from the platform as soon as possible.
Technical Analysis and Impact
Bunni operates by channeling liquidity through Euler Finance, a decentralized lending protocol. Following the exploit, Euler�s leadership clarified that its own protocol was not affected by the attack.
Preliminary analysis by developers, including KyberNetwork co-founder Victor Tran, suggests that the attacker manipulated Bunni�s custom Liquidity Distribution Function (LDF). This function, designed to optimize liquidity allocation, was exploited through trades of carefully selected sizes, disrupting the rebalancing calculation for liquidity provider shares. The attacker executed several such transactions without immediately drawing attention.
- Bunni has paused smart contract operations on all networks.
- Users are strongly encouraged to withdraw remaining funds.
- A technical post-mortem is pending, with further updates expected from Bunni�s team.
Context: Crypto Security Challenges Persist
The Bunni incident follows a broader rise in crypto-related exploits. August saw a 15% monthly increase in hacks and scams, with losses reaching $165 million, according to security researchers. Although overall losses are down from the previous year, targeted attacks have become more sophisticated, often impacting centralized exchanges and high-value individuals.
Investigations into the Bunni exploit are ongoing as the team and the community seek to understand the full scope of the vulnerability and potential recovery options.
Related content
Comments
