Bunni Protocol Suffers $2.3M Exploit on Ethereum

The Bunni Protocol, a DeFi project on Ethereum, has been exploited for approximately $2.3 million, according to real-time alerts from blockchain security tool BlockSec Phalcon.

Phalcon flagged suspicious on-chain activity, triggering alarms over a potential unauthorized transaction. The likely culprit seems to be a previously identified vulnerability in Bunni’s smart contract—specifically, the sweepToken() function in the PeripheryPayments contract. This function lacked access controls, meaning anyone could potentially drain tokens from BunniHub. It is unclear whether this bug had been patched prior to the exploit.

Bunni simplifies handling Uniswap V3 liquidity provider (LP) NFTs by wrapping and facilitating their trade—but this sophistication did not prevent the breach.

In response, the market may face volatility, as confidence in Bunni’s token and liquidity pools is shaken. The broader DeFi community is now monitoring how Bunni’s team will handle potential fixes or temporary contract suspensions, with the next 24–48 hours seen as critical for determining whether the stolen funds could be recovered.