PancakeBunny Mint Manipulation

On May 19, 2021, the BSC yield aggregator PancakeBunny was exploited for approximately $45 million — 114,631 WBNB worth roughly that amount at then-prices. A $704 million flash loan from PancakeSwap and ForTube Bank funded a price-manipulation attack that abused the protocol's BUNNY-reward mechanism to mint ~7 million BUNNY tokens from nothing. The BUNNY token crashed from $146 to $6 within minutes.

What happened

PancakeBunny operated a yield-aggregation protocol where users deposited assets and earned BUNNY tokens as reward. The amount of BUNNY minted as reward was calculated using an on-chain price oracle that read from the BUNNY/BNB and USDT/BNB pools on PancakeSwap.

The attacker realised these price oracles could be temporarily manipulated by anyone with enough capital to move the underlying pool balances. With a flash loan, that capital is free.

The attack:

1. Flash-borrowed 2.3M BNB (~$704M at the time) from seven PancakeSwap pools.
2. Flash-borrowed 2.9M USDT from ForTube Bank.
3. Manipulated both the USDT/BNB and BUNNY/BNB prices simultaneously by routing large swaps through the relevant pools.
4. Triggered PancakeBunny's reward calculation, which read the manipulated BUNNY/BNB price as input. The protocol believed it owed the attacker a massive BUNNY reward and minted ~7M BUNNY from thin air.
5. Dumped the freshly minted BUNNY for BNB and other assets in the same transaction.
6. Repaid the flash loans, walking with ~114,631 WBNB profit.

PancakeBunny's TVL — which had exceeded $10 billion before the attack — fell to just over $1 billion in its aftermath as the BUNNY token's collapse and the broader trust loss drove withdrawals.

Aftermath

• PancakeBunny paused operations and announced a redesigned protocol that would calculate prices using Chainlink oracles for "fair" pricing, rather than internal pool reads.
• The team launched a recovery plan including pBUNNY rewards intended to compensate affected depositors over time. Recovery was partial; many users absorbed real losses.
• The stolen funds were laundered through Tornado Cash; no public recovery.
• PancakeBunny suffered a second, smaller hack in July 2021 ($2.4M) before its overall standing in BSC DeFi collapsed.

Why it matters

PancakeBunny is the canonical case for why reward calculations must not read manipulable prices in the same transaction the reward is claimed. Every yield aggregator that calculates user rewards from a current pool price — without time-weighting or external oracle anchoring — is one flash loan away from PancakeBunny's outcome.

The structural pattern — mint protocol-controlled tokens against a manipulated price — recurs across the DeFi era at Cream Finance, Beanstalk, Cetus and many others. PancakeBunny was an early, clean execution of the playbook on BSC, before flash-loan-resistant oracle patterns had become standard practice in the ecosystem.