Bunni DEX shuts down after $8.4 million exploit, citing lack of funds

Decentralized exchange Bunni has announced that it is shutting down operations, citing financial constraints following a recent $8.4 million exploit.

In a Wednesday post on X, Bunni said that it does not have enough resources to fund a secure relaunch.

"The recent exploit has forced Bunni's growth to a halt, and in order to securely relaunch we'd need to pay 6-7 figures in audit and monitoring expenses alone – requiring capital that we simply don't have," the team said.

Bunni added that it would take months of business development effort to restore operations, which the project can't afford. "Thus, we have decided it's best to shut down Bunni," the team said.

The platform suffered an exploit last month that resulted in $8.4 million in losses. Its post-mortem revealed that attackers exploited a rounding error in its smart contract withdrawal function. 

With the protocol ceasing operations, Bunni said users will still be able to withdraw assets on its website until further notice. The team plans to distribute remaining treasury assets to holders of BUNNI, LIT, and veBUNNI based on a snapshot, pending legal validation. Team members will be excluded from the distribution, according to the post.

Despite winding down the exchange, Bunni noted that it has relicensed its V2 smart contracts from Business Source License to the less-restrictive MIT license, allowing other developers to use its innovations such as liquidity distribution functions, surge fees, and autonomous rebalancing mechanisms.

Bunni said it is cooperating with law enforcement to pursue recovery of the stolen assets. According to Bunni's post-mortem report, the $8.4 million worth of stolen assets have already been laundered through Tornado Cash. The team offers the attacker a 10% bounty to return the remaining funds.