Zunami Protocol Hack

On May 14, 2025, the Zunami Protocol deployer wallet gave admin roles on two privileged strategy contracts to an outside address. Minutes later, that address used the contracts' withdrawStuckToken() function to remove the Curve LP collateral backing Zunami's zunUSD and zunETH stablecoins. About $500,000 was lost. Zunami announced the exploit on May 15.

No contract bug was needed. The deployer key could grant DEFAULT_ADMIN_ROLE on the strategies, and an admin could pull any token out through withdrawStuckToken(). Rekt noted that the strategies had never been moved to DAO control as the team had promised. The drained collateral was turned into ETH, and 26 Tornado Cash deposits totalling about 204.2 ETH followed within thirteen minutes of the drain.

The cause of the key misuse is unresolved. Zunami's founder said the team was considering both a compromised deployer and malicious intent by the key holder. The CTO suggested his laptop, with unencrypted protocol code, had been seized and cloned at a Russian border crossing. No recovery has been reported.

Zunami deployer: [0xe9b2B067eE106A6E518fB0552F3296d22b82b32B](Address 0xe9b2…b32B)

Attacker: [0x051370419b871f7c05dee8f7134401530832e250](Address 0x0513…e250)

Role grant: [0x2697a6f0...](Tx 0x2697…e3b0)

Drain: [0xd7ce5099...](Tx 0xd7ce…14d2)