SurgeBNB suffered a reentrancy attack funded by a 10,000 BNB flash loan. The sell function updated balances after external calls, letting attacker repeatedly withdraw value.