PancakeBunny (BUNNY) is a Defi Yield Farming Aggregator and Optimizer for the Binance Smart Chain and Polygon. The PancakeBunny protocol allows farmers (users) to reap the benefits of auto-compounding. ^[1][9]

Overview

BUNNY Token is Pancake Bunny native governance token. BUNNY holders govern the ecosystem and receive the majority of farm performance fee profits. Holding/Staking BUNNY is not only beneficial for individual profits but also ensures the Bunny Ecosystem runs efficiently. ^[2][3]

BUNNY provides strategies for various needs of farmers from the highest yield seekers to the risk-reward optimizing smart investors. Every Farm requires a different Flip Token. Furthermore, the different Farms represent different risk tolerances for Bunny users. ^[4][5]

The BUNNY token doesn’t have a maximum supply. For every 1 BNB earned in the performance fees, 40 BUNNY is minted, so supply is not capped. ^[10]

Governance

BUNNY holders control the ecosystem and receive the majority of farm performance fee profits. In order to claim these profits, BUNNY holders stake their tokens in the BUNNY Governance Pool. Profits are sent to this pool in the form of BNB rewards. ^[9]

The amount of profits users receive is determined by the number of BUNNY tokens user stake (%of the pool). Later on, these governance tokens will be used to vote on decisions within BUNNY community. Thus the more BUNNY user stake, the higher the user influence in the ecosystem. ^[11]

Hack

In May 2021, PancakeBunny experienced an exploit resulting in the loss of over $200 million in crypto assets. According to the PancakeBunny team, the protocol was subjected to a flash loan attack by an external actor. ^[12]

The attacker borrowed a large amount of Binance Coin (BNB), manipulated its price, and then dumped it on the platform’s BUNNY/BNB market. This caused the price of BUNNY to spike from $150 to $240 before crashing to $0 within 30 minutes.

After stabilizing below $10 for approximately two hours, BUNNY was last traded at $8.8. The hacker drained only the BUNNY/BNB pool, seizing 697,000 BUNNY and 114,000 BNB. With Binance Coin valued at around $296 at the time, the stolen assets were estimated to be worth $200 million. ^[12]

Transformation to DAO

Pancake Bunny was unable to recover the stolen funds and eventually dissolved the protocol, transforming it into a decentralized autonomous organization (DAO) in February 2022. In an official Medium post, the Bunny Finance team announced that the exploit made it impossible for the team to operate at full scale. Thus, it has decided to disband the protocols and give authority to the community. ^[13][14]

"Due to this terrible incident, it became impossible to sustain the scaled development team. As a result, Bunny and Qubit protocols, which were primarily led by the development team, will be governed by DAO."^[13]

Cash Siphon through Tornado Cash

In July 2024, a wallet address associated with the PancakeBunny attack moved 1,002 Ether (ETH) — valued at over $3 million — through the privacy protocol Tornado Cash after three years of dormancy. ^[15][16]

CertiK, a blockchain security company reported the move on July 8, 2024, tweeting;

"On Sunday the @PancakeBunnyFin exploiter deposited 1002 ETH (~$2.9m) into @TornadoCash via 0xd0f2259e0bd71e849143bbc07f4e427bb6f7756b
Bunny Finance was exploited for ~$45m in May 2021. The exploiter still holds $11.4m DAI in 0x820C" ^[17]

The CBO of CertiK, Jason Jiang, spoke with Cointelegraph on tracking the funds saying:

"The chances of recovery are quite slim."

He explained that the longer the funds stay in Tornado Cash, the harder it becomes to link it back to the hack, adding:

“If they withdraw it in amounts of 1x 100 ETH once a month, it becomes practically impossible to trace depending on how many other people use Tornado Cash.”^[16]