On September 2, 2025, a rounding error in Bunni V2's withdrawal logic allowed attackers to systematically withdraw more tokens than entitled, draining $8.4M across Ethereum ($2.4M) and UniChain ($5.9M).