PancakeBunny (2021) — Crypto Hack
LaunderedPancakeBunny lost $45M when an attacker used a massive BNB flash loan to manipulate BUNNY token prices and mint inflated BUNNY rewards.
Summary
PancakeBunny lost $45M when an attacker used a massive BNB flash loan to manipulate BUNNY token prices and mint inflated BUNNY rewards.
How It Was Compromised — DeFi via Flash Loan / Oracle Manipulation
The attacker flash-loaned 697,000 BNB (~$253M) and used it to buy large quantities of BUNNY tokens on PancakeSwap, dramatically inflating the price. PancakeBunny's minting mechanism used the BUNNY price to calculate reward distributions, so the inflated price triggered minting of 7M BUNNY tokens to the attacker. The BUNNY price subsequently crashed 95% as the attacker sold.
Fund Flow & Laundering Analysis
BNB proceeds from selling BUNNY tokens converted to stablecoins via PancakeSwap. Funds routed through multiple BSC wallets before being bridged to Ethereum and mixed via Tornado Cash. The BUNNY token price collapse destroyed approximately $1B in market cap. PancakeBunny launched a compensation fund and introduced PEG token for affected users.