Bunni V2 hack — September 2025

On 2 September 2025 an attacker exploited a rounding bug in Bunni V2, a liquidity manager built as a hook on Uniswap V4, draining the USDC/USDT pool on Ethereum and the weETH/ETH pool on Unichain.

Bunni's post-mortem, published two days later, identifies the root cause as the rounding direction used when updating idle balances inside BunniHubLogic::withdraw. The code rounded down, which the team described as safe for any single operation but exploitable when chained. The attacker flash-borrowed 3 million USDT and swapped it to push the pool's price tick to an extreme value, reducing the active USDC balance to 28 wei. They then made 44 tiny withdrawals that compounded the rounding error, cutting the USDC active balance by 85.7% and total pool liquidity by 84.4% while burning almost no liquidity shares. A large reversing swap then restored the artificial liquidity, and the attacker sandwiched subsequent swaps at the distorted prices. Bunni reported the net profit after flash-loan repayment as roughly 1.33 million USDC and 1 million USDT on the Ethereum leg.

Reported totals are close: The Block, Decrypt and CoinDesk all cite about $8.4 million, while QuillAudits' breakdown of $2.4 million on Ethereum and $5.9 million on Unichain gives $8.3 million.

Bunni paused deposits and swaps, reopened withdrawals after testing by Cyfrin, offered the attacker a 10% bounty, contacted exchanges and engaged law enforcement. The funds were bridged to Ethereum and left in wallets funded through Tornado Cash. On 23 October 2025 Bunni announced it was shutting down, saying a secure relaunch would cost six to seven figures in audits and monitoring it no longer had, and relicensed its V2 contracts from BUSL to MIT.