Bungee
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 42 → 62. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Problems around it, caused by others | -3.2 |
| Long-running | +10 |
| Sum | 62 |
Score: 62/100 (kept between 0 and 100)
How scoring works →Summary
Bungee Exchange is a cross-chain bridge aggregator and liquidity routing protocol developed by Socket (formerly SocketDotTech), founded in 2021 by Vaibhav Chellani and Rishabh Khurana. On January 16, 2024, the underlying Socket infrastructure was exploited via an inadequately validated smart contract route, resulting in approximately $3.3 million stolen from roughly 700 wallets with infinite token approvals. The protocol recovered approximately $2.23 million of the stolen funds one week later and resumed operations; it remains active as of 2026.
Connected Entities
6 entities · 60 linked investigations- Socket Protocol→mentioned with→Bungee(80%)
- Socket Protocol→mentioned with→Coinbase(80%)
- Coinbase→mentioned with→ZachXBT(70%)
- Bungee→mentioned with→Socket Protocol(80%)
- Bungee→mentioned with→Polymarket(60%)
- Bungee→mentioned with→Coinbase(70%)
- Bungee→mentioned with→Synthetix(60%)
- Bungee→mentioned with→ZachXBT(70%)
Connected Through
6 shared actors · 622 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □ZachXBTorganization
- ♦Coinbasetoken
- □Polymarketorganization
- □Synthetixorganization
Timeline(8 events)
2021
Socket Protocol founded by Vaibhav Chellani and Rishabh Khurana, previously from Biconomy.
2022
Socket raises seed/pre-seed funding from Coinbase Ventures, Lightspeed Venture Partners, Framework Ventures, Nascent, and others, reportedly totalling $5–12 million across rounds.
13 January 2024
Socket admin deploys a new bridging route to the SocketGateway contract containing an unvalidated .call() vulnerability.
16 January 2024
Exploit executed: attacker drains approximately $3.3 million from ~700 wallets with infinite token approvals to SocketGateway. @speekaway first flags attack at 18:20 UTC; PeckShield reports at 14:26 ET; Socket confirms and pauses contracts.
17 January 2024
Socket and Bungee restart bridging operations after patching the vulnerable route. Compensation plan for victims announced.
23 January 2024
Socket announces recovery of 1,032 ETH (~$2.23 million) of stolen funds; victim claim process initiated via on-chain message signing.
2024
CertiK publishes post-incident technical analysis confirming incomplete input validation as root cause.
27 April 2026
Bungee Exchange reports all services fully operational per its public status page.
Decision Log
- slot 455363874 · hash DrPcdC6mYipS4ciYPEe4dyFMNCRTovMJc7MVXTzR6Gy3
- slot 422682007 · hash AyesMrEAgwaW8KxnaGQcQmgoeMXje9QBGvyrD96F7xL1
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 14 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:35 AM
last updated: 10/10/2026, 6:44:10 PM
5 viewsavoid.net — verified advice for a post-truth world