According to CryptoComLearn, two Binance Smart Chain (BSC) decentralized finance (DeFi) projects suffered back-to-back flash loan attacks within five days, resulting in a combined loss of approximately $6 million. On May 19, the yield-farming platform PancakeBunny lost roughly $3 million, followed by Bogged Finance on May 23, which saw another $3 million drained from its liquidity pools. The incidents underscore the persistent security vulnerabilities tied to flash loans in the DeFi ecosystem.
PancakeBunny Exploited: Price Manipulation Drains Nearly $3M
PancakeBunny announced via Twitter that an attacker used a flash loan to borrow a large amount of BNB from PancakeSwap. The hacker then manipulated the price of USDT/BNB and BUNNY/BNB pairs, obtaining a huge amount of BUNNY tokens. After dumping the tokens on the market, the BUNNY price plummeted, and the hacker repaid the borrowed BNB. The attack resulted in an estimated $3 million loss. Following the news, BUNNY's market cap fell by 95%, severely damaging investor confidence.
Bogged Finance Next: Complex Flash Loan Attack Drains $3M in Liquidity
Just days later, another BSC project, Bogged Finance, fell victim to a similar exploit. The project's post-mortem revealed that an unknown attacker deployed a complex flash loan-based attack, draining $3 million out of the total $6 million in liquidity. The team managed to halt the attack within 15 blocks, preventing a full loss. To recover the stolen assets, Bogged Finance planned to force-migrate the contract using the same exploit vector, removing illegitimately obtained tokens. All holders were promised new LP tokens and BOG tokens on a fresh contract. However, as of May 24, the migration process took longer than expected.
Token Markets Crushed, Security Lessons Renewed
The attacks caused catastrophic price drops. BOG token slid from $1.80 to $0.0003, approaching zero. BUNNY also lost 95% of its value. Flash loan attacks have become a common threat in DeFi, originally seen in early Bzx exploits. Project developers must strengthen price oracle designs and liquidity depth to mitigate such manipulation risks.
Both projects are actively handling aftermaths, but the BSC ecosystem faces renewed scrutiny over security resilience. Investors are advised to stay updated on recovery plans and compensation measures.