Bunni Decentralized Exchange Hit by $2.3 Million Smart Contract Exploit

Bunni, a decentralized exchange platform, experienced a significant security breach resulting in the loss of approximately $2.3 million in stablecoins. This incident has led the exchange to suspend all operations while it continues to investigate the matter.

Key Takeaways

Bunni suffered a smart contract exploitation, losing around $2.3 million in stablecoins.
The exchange has paused all smart contract operations while investigating.
BlockSec detected suspicious activity targeting Bunni's contracts.
The attacker targeted a specific flaw in Bunni’s Liquidity Distribution Function to exploit the system.
August was a particularly damaging month for decentralized finance (DeFi), with losses from hacks totaling around $163 million.

Decentralized exchange Bunni hit by $2.3m smart contract exploit

On September 2, 2025, the decentralized exchange Bunni reported a smart contract exploit that compromised the funds stored within the platform. The exchange took immediate action to halt all smart contract functions across its networks to mitigate further losses. Blockchain security firm BlockSec identified suspicious transactions linked to a flaw in Bunni's contracts, enabling the malicious actor to drain funds.

The Incident at Bunni

On September 2, 2025, Bunni faced a security breach that allowed an attacker to exploit a weakness in its smart contracts. This resulted in a loss of approximately $2.3 million in stablecoins, prompting the decentralized exchange to suspend all smart contract functions across all networks to prevent further damage.

The announcement was made via a post on X, where Bunni stated:

“The Bunni app has been affected by a security exploit. As a precaution, we have paused all smart contract functions on all networks. Our team is actively investigating and will provide updates soon.”

Identification of the Exploit

Blockchain security company BlockSec was among the first to note the suspicious activity. They reported that an attacker was taking advantage of a flaw in Bunni’s smart contracts to drain funds, stating:

“ALERT! Our system detected a suspicious transaction targeting @bunni_xyz’s contract on #Ethereum, and the loss is ~$2.3M. Please take actions ASAP.”

Mechanics of the Attack

The attacker executed a series of strategically sized trades aimed at exploiting Bunni’s Liquidity Distribution Function (LDF), a custom mechanism designed to enhance liquidity distribution across different price ranges and to support more complex trading strategies. Each trade leveraged this mechanism, disrupting the pool’s balance and enabling the attacker to withdraw more tokens than were actually available. By repeating this process, the attacker was able to drain a total of around $2.3 million in stablecoins.

Current Status of Stolen Assets

On-chain data reveals that the stolen funds are now held in a single Ethereum wallet, which contains approximately $1.33 million in USDC USDC and $1.04 million in Tether (USDT) Tether .

Context of the Attack

This incident marks the first significant decentralized finance (DeFi) exploit of September, following a series of high-profile hacks in August that had already caused turmoil within the crypto industry. August was particularly harsh, as it recorded losses of around $163 million from various breaches, which was a substantial increase compared to July's losses of $142 million. Notably, major attacks included a social engineering breach that stole $91 million from a Bitcoin whale, alongside a significant hack targeting the Turkish exchange BtcTurk, which resulted in losses of approximately $48 million.

The wave of exploits in August made it one of the costliest months for the industry in 2025, compounding the significant impacts felt from the first half of the year, where total losses exceeded $3.1 billion—well beyond the $2.2 billion reported for all of 2024.