PancakeBunny is a yield optimizer on BNB Smart Chain. Users deposit tokens into its vaults, and its smart contracts harvest the farming rewards and reinvest them automatically. Its token is BUNNY. The project is best known for a flash loan attack on 19–20 May 2021 that took about $45 million. On the day, BUNNY fell from $146 to $0.90 (The Block, 20 May 2021). As of 25 October 2026, CoinGecko lists BUNNY at about $0.0198, with a market capitalisation of about $10,100 and $182 in 24-hour trading volume. That is a tiny fraction of its 2021 level.
How PancakeBunny works
The project's documentation says PancakeBunny "calculates the most optimal compounding frequency and automatically compounds your tokens through smart contracts." Its main farming venue is a decentralised exchange on BNB Smart Chain whose reward token is CAKE.
A user would otherwise have to claim CAKE rewards, swap them and redeposit them by hand. A PancakeBunny vault does those steps for every depositor. It reinvests the earned token in its own form until the user withdraws.
Vault types
The documentation lists these farm types:
- BUNNY staking pool: stake BUNNY and receive WBNB. Returns depend on how the other farms perform. This pool charges no performance or withdrawal fee.
- BUNNY/BNB farm: deposit BUNNY/BNB liquidity tokens to earn more BUNNY.
- CAKE auto-compounding farm: automates CAKE compounding.
- Other liquidity-pool farms (for example CAKE-BNB, USDT-BUSD): profits come as LP tokens plus BUNNY and can be claimed only by exiting the pool.
- Maximizer farms: profits from the compounded farms move into the CAKE auto-compounding farm. This is the only type where users can claim profits without exiting.
- Single-asset smart vaults (BNB, ETH, BTCB, USDT, BUSD): idle principal goes to the Venus lending protocol. The vaults adjust leverage according to borrowing interest rates.
Fees
According to the project's documentation:
| Fee | Rate |
|---|---|
| Performance fee on farm profits | 30%, paid to BUNNY stakers |
| Withdrawal fee | 0.5% if withdrawn within 72 hours of deposit |
| BUNNY pool | No performance or withdrawal fee |
The documentation does not mention a deposit fee.
The BUNNY token
The BUNNY token page says:
- Supply: "The BUNNY token doesn't have a max supply." The page adds that this could change later. Some price trackers now list a 1,000,000 maximum supply. We could not confirm from the project which figure is current.
- Minting: "For every 1 BNB earned in the performance fees, 15 BUNNY is minted." Roughly 13% of all BUNNY mints go to development.
- Governance: holders stake BUNNY in the governance pool and vote on Snapshot. Voting power and the BNB profit share grow with the amount staked.
The link between profits and minting matters for what happened next. New BUNNY was minted according to how much value the protocol thought it had earned. Anyone who could inflate that number could mint tokens they had not earned.
CoinGecko lists a circulating supply of 510,232 BUNNY and an all-time high of $512.75 (data as of 25 October 2026).
The May 2021 exploit
A flash loan is a loan with no collateral that must be borrowed and repaid in the same transaction. If it is not repaid, the whole transaction is reversed (ethereum.org). Flash loans let an attacker control very large sums for the length of a single transaction.
Here is what happened, as reported by The Block (20 May 2021) and Halborn (21 May 2021):
- Borrow: the attacker took eight flash loans: seven from pools on a decentralised exchange and one from ForTube Bank. They totalled nearly $707 million, including 2.3 million BNB (about $704 million) and 2.9 million USDT.
- Skew prices: the borrowed funds were used to shift the reserves of the BNB-USDT and BUNNY-BNB pools.
- Mint: BUNNY's minting formula used the BNB-USDT pool price, which the attacker had just moved. The protocol minted about 7 million BUNNY.
- Dump and repay: the attacker sold most of the new BUNNY for BNB and repaid the loans in the same transaction.
- Keep the rest: Halborn says the attacker kept 114,631 WBNB, worth about $45 million.
Sources disagree on the date. Halborn gives 19 May 2021, and other reports use 20 May (UTC). The Block reported that BUNNY fell from $146 to $0.90 and recovered to about $28 later that day.
Root cause: the mint calculation trusted a pool price that a single transaction could move. Halborn reports that the fix was to price assets through a Chainlink contract in the token price oracle instead of calculating swap values internally.
How PancakeBunny went from exploit to near-zero
Step through the dated events in the article to see what happened to PancakeBunny and its BUNNY token, and when.
- 19–20 May 2021Eight flash loans skew two poolsexploit
The attacker borrowed nearly $707 million in eight flash loans, including 2.3 million BNB and 2.9 million USDT, and used them to shift the reserves of the BNB-USDT and BUNNY-BNB pools. Halborn dates it 19 May; other reports use 20 May (UTC).
- 19–20 May 2021About 7 million BUNNY minted from a moved priceexploit
BUNNY's minting formula used the BNB-USDT pool price the attacker had just moved. The attacker sold most of the new BUNNY for BNB, repaid the loans in the same transaction and kept 114,631 WBNB, worth about $45 million (Halborn).
- 20 May 2021BUNNY falls from $146 to $0.90price
The Block reported that BUNNY fell from $146 to $0.90 and recovered to about $28 later that day.
- After May 2021Price source changed to Chainlinkfix
Halborn reports that the fix priced assets through a Chainlink contract in the token price oracle instead of calculating swap values internally. The article gives no date for the change.
- 16 July 2021PolyBunny on Polygon is exploitedexploit
With an Aave flash loan, the attacker inflated the performance fee, about 2.1 million polyBUNNY were minted and about 1,281 ETH (about $2.4 million) was taken. polyBUNNY fell 82%, from $10 to just over $2. The team said it would distribute $2.4 million in MND tokens to holders.
- 25 October 2026BUNNY trades at about $0.0198current
CoinGecko lists BUNNY at about $0.0198, with a market capitalisation of about $10,100, $182 in 24-hour volume and an all-time high of $512.75.
This shows only the dated events reported in the article: it does not cover current TVL or whether the team is active (neither could be verified), and it is not a view on the token.
The PolyBunny exploit, July 2021
PolyBunny was the project's version on Polygon. It was attacked on 16 July 2021. According to the team's post-mortem, as reported by CryptoSlate:
- The attacker deposited about $19,203 in a Bunny vault and about $47.99 million directly into a pool on another decentralised exchange, using an Aave flash loan. The attacker then called the vault's
withdrawAllfunction. - The manipulated price inflated the performance fee, and about 2.1 million polyBUNNY were minted.
- The attacker kept about 1,281 ETH, worth about $2.4 million.
- polyBUNNY fell 82%, from $10 to just over $2.
- Team Bunny said it would distribute $2.4 million in MND tokens to polyBUNNY holders at the time of the attack. It also said it had "revised its protocols to maximize security for the launch of new products."
The same weakness, minting tied to a price that could be manipulated, was exploited a second time two months later.
What the case teaches about yield optimizers
These checks come straight from what went wrong. They are not a rating of any current protocol:
- Find out where the price comes from. If minting, rewards or fees depend on a price, check whether it comes from a single pool's spot price. A flash loan can move that price inside one transaction.
- Treat token minting as a risk. A token minted from reported profits can be inflated by inflating the profit figure.
- Each deployment needs its own review. The Polygon version carried the same kind of flaw as the BNB Smart Chain original.
- Read the audit page. PancakeBunny's documentation names one auditor, Haechi Labs, and refers to "the first audit," with no date. An audit is not a guarantee.
- Check current activity before relying on anything. As of 25 October 2026, BUNNY's 24-hour trading volume on CoinGecko was under $200. The project's website still loads, but we could not verify its current total value locked or whether the team is still active.
Limitations
The fee and token rules come from PancakeBunny's own documentation, which has no dates and may describe an earlier version. Current TVL, the team's status and some post-exploit claims could not be verified.
