PancakeBunny (BUNNY)
A BNB Chain yield aggregator hit by a flash-loan price-manipulation 'economic exploit' on May 19, 2021. The attacker minted ~6.97M BUNNY and dumped it for about $45M in profit, crashing BUNNY from ~$146 to near $1; the team said no vaults were breached.
Also known as: PancakeBunny, Bunny Finance, BUNNY
Summary
PancakeBunny was a popular yield-aggregator on BNB Chain. On May 19, 2021, an attacker used a series of flash loans (borrowing roughly $700 million in BNB and USDT) to manipulate the price of PancakeSwap LP pools that fed PancakeBunny's reward oracle, causing the protocol to mint about 6.97 million BUNNY as "reward," which the attacker immediately sold. [1][2]
Impact
The team said this was an "economic exploit" rather than a vault breach — no deposited vault funds were directly stolen — but the mass minting and dump crashed BUNNY from about $146 to near $1 (roughly a 95–100% drop), wiping out holders. Analysts (PeckShield) put the attacker's profit at about $45 million. PancakeBunny later published a compensation plan. [1][2]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
