A flaw in Bunni’s custom liquidity logic allowed an attacker to drain about $2.4 million in stablecoins, prompting the platform to pause all contracts.