SurgeBNB (xSurge) hack — August 2021

SurgeBNB was one of several "Surge" tokens issued by xSurge on BNB Chain. Its contract acted as its own market: buyers sent BNB to the contract to mint SURGE, and sellers called a sell function that paid BNB back out of the contract's reserve.

On 16 August 2021 an attacker exploited a re-entrancy flaw in that sell path. The contract sent BNB to the seller before updating its own supply and balance state, so a contract-based seller could re-enter through its fallback function and buy SURGE back at the stale, pre-update price. Funded by a 10,000 BNB flash loan in the first round, the attacker repeated the buy-sell-buy cycle several times, accumulating SURGE far below the price the contract believed it was quoting, and then liquidated the position. One of the exploit transactions is timestamped on BscScan at 16 August 2021, 19:40 UTC, sent from an address labelled XSURGE Exploiter 1.

Independent write-ups by Knownsec Blockchain Lab and by Beosin, the latter published in English via Odaily, both put the loss at roughly $5 million; Beosin traced the attacker's profit at more than 13,111 BNB.

The SurgeBNB contract was immutable and could not be patched. xSurge published a security alert dated 16 August 2021 telling holders to sell their SurgeBNB immediately through the contract's write function on BscScan, stating that the vulnerability did not affect the SurgeUSD and SurgeETH contracts and that SurgeBNB would be re-released only after a full audit was completed. The alert did not disclose a loss figure. The stolen BNB was never returned and no arrests have been reported.