SurgeBNB
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 26. Problems weighed by who is responsible: incidents the subject suffered −20, the subject's own conduct −15, concerns that are not fraud −6, problems around the subject, caused by others −2.3; no established finding that it defrauded anyone, so it stays out of the red band. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -15 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -2.3 |
| Sum | 22 |
- No established finding that it defrauded anyone, so it stays out of the red band (26 or above).
Score: 26/100 (kept between 0 and 100)
How scoring works →Summary
SurgeBNB was a BEP-20 yield token on Binance Smart Chain operated by the XSurge DeFi project. On August 16–17, 2021, an attacker exploited a reentrancy vulnerability in the contract's sell() function via a flash loan, draining approximately 13,111 BNB (~$5 million USD) from the protocol. The project had publicly claimed to be 'rug-proof' prior to the exploit; post-hack, the team launched a 'SurgeFund' compensation scheme, though the extent and completion of repayment to victims remains unclear.
Connected Entities
4 entities · 60 linked investigations- ZachXBT→mentioned with→Binance(60%)
- SurgeBNB→mentioned with→Binance(60%)
- SurgeBNB→mentioned with→ZachXBT(70%)
- SurgeBNB→mentioned with→SafeMoon(70%)
- SafeMoon→mentioned with→Binance(65%)
Timeline(8 events)
30 July 2021
Developer 'SafemoonMark' (DefiMark) publicly touts SurgeBNB as safe from rug pulls via Twitter.
16 August 2021
XSurge team publicly warns community of an unpatched vulnerability in the SurgeBNB contract and urges users to migrate funds immediately.
16 August 2021
SurgeBNB contract is exploited via a flash loan reentrancy attack; over 13,111 BNB (~$5 million USD) drained from the protocol.
17 August 2021
Official XSurge Twitter account (@XSURGEDEFI) confirms the hack and posts attacker wallet details.
17 August 2021
BEOSIN publishes full technical post-mortem identifying the reentrancy vulnerability in the sell() function.
17 August 2021
Knownsec Blockchain Lab publishes independent flash loan attack analysis corroborating BEOSIN findings.
17 August 2021
DefiMark hosts Discord AMA livestream to address community concerns about the SurgeBNB hack.
September 2021
XSurge launches SurgeFund compensation mechanism; SurgeFund Repayment (SFR) token issued to track victim claims.
Decision Log
- slot 455362372 · hash F1XHs2P1c1ZDq41u4uQn1y2Gb9z3h4R4KqKFtG7Ydj6u
- slot 422768951 · hash 6EsabKDFPcnreN9zZezqy28F6hDPuYijwkRVXrzX7zy7
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 5 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:54 AM
last updated: 10/10/2026, 6:42:38 PM
5 viewsavoid.net — verified advice for a post-truth world