Bunni has confirmed it will shut down permanently following an $8.4 million exploit in early September that depleted the team's resources for recovery. The decentralized exchange, built on Uniswap v4, cited prohibitive costs ranging into six or seven figures for security audits and monitoring required to relaunch the protocol safely.
Exploit Details and Impact
The September attack targeted BunniHub, the platform's core smart-contract infrastructure, affecting deployments on both Ethereum and Unichain. Blockchain security firm CertiK traced the stolen funds to two Ethereum addresses immediately after the breach occurred.
Months of development work and business development efforts would be necessary to restore Bunni to its pre-exploit operational state. The team stated these resource requirements exceed their current capabilities, making permanent closure the only viable path forward given the financial constraints.
Exploit Methodology
The exploit methodology involved a three-step process utilizing flash loans, according to Bunni's post-mortem analysis. The attacker flash-borrowed 3 million $USDT, executed multiple swaps between $USDT and $USDC, then conducted numerous small withdrawals before completing a sandwich attack that manipulated pool pricing.
Kadan Stadelmann, Chief Technology Officer at Komodo Platform, emphasized that the incident demonstrates how custom liquidity logic demands exhaustive testing. Flash loans create low-risk exploitation opportunities when protocols lack comprehensive security validation across all smart contract functions.
Asset Withdrawal and Treasury Distribution
Users retain the ability to withdraw assets through the platform's website while legal review continues for treasury distribution. Remaining funds will be allocated to BUNNI, LIT and veBUNNI token holders through a snapshot mechanism, with team members excluded from the payout structure pending compliance verification.
Open-Sourcing Technology
Bunni has relicensed its v2 smart contracts from BUSL to MIT, enabling developers across the ecosystem to utilize innovations including liquidity distribution functions, surge fees and automated rebalancing features. The team expressed hopes that releasing this technology will benefit the broader DeFi community despite the platform's closure.
Law Enforcement and Recovery Efforts
Law enforcement cooperation remains active as Bunni works to track the exploiter and recover stolen assets. The team sent an on-chain message offering the attacker 10% of the funds in exchange for returning the remainder, though this proposal received no response from the responsible party.
Industry Context
Elliptic data shows hackers have stolen over $2 billion in digital assets during 2025, with North Korea-linked groups accounting for the majority of losses. The Bunni breach contributes to what has become the largest annual total on record for digital asset theft across the industry.