BigONE Exchange Loses $27 Million in Supply Chain Cyberattack

Cryptocurrency exchange BigONE confirmed a $27 million security breach on July 16, 2025, after hackers used a sophisticated supply chain attack to drain funds from the platform’s hot wallet.

The breach differed from typical crypto exchange hacks. Instead of stealing private keys or breaking into wallets directly, attackers targeted BigONE’s production network infrastructure. SlowMist, a blockchain security firm that investigated the incident, reported that hackers compromised the exchange’s production network and modified the operating logic of servers that handle account management and risk controls.

According to security firm Cyvers, the attack began with malicious binaries deployed to account-operation servers through compromised CI/CD (Continuous Integration and Continuous Deployment) or server management channels. This allowed attackers to disable key security checks and authorize unauthorized withdrawals without accessing the exchange’s private keys.

The attackers essentially reprogrammed the exchange’s internal systems to approve their withdrawal requests as legitimate transactions. This manipulation allowed them to bypass traditional security measures and withdraw funds across multiple blockchain networks.

On-chain tracking firm Lookonchain reported that hackers quickly converted the stolen assets into 120 Bitcoin ($14.15 million), 23.3 million TRON tokens ($7.01 million), 1,272 Ethereum ($4 million), and 2,625 Solana tokens ($428,000).

The stolen funds included:

• 120 Bitcoin (BTC)
• 350 Ethereum (ETH)
• 1,800 Solana (SOL)
• 8.54 million USDT across multiple networks
• Various smaller tokens including Dogecoin, Shiba Inu, and CELR

The hackers immediately fragmented the stolen funds, pushing them through bridges and decentralized exchanges to make tracking more difficult. Security firms have identified the wallet addresses being used to move the stolen cryptocurrency across different blockchain networks.

BigONE moved quickly to contain the damage. The exchange temporarily suspended deposits and withdrawals while working with SlowMist to trace the stolen funds and identify the attack methods.

The exchange pledged to cover all losses using internal security reserves that include Bitcoin, Ethereum, USDT, Solana, and Mixin tokens. For other affected cryptocurrencies, BigONE said it would secure external funding through borrowing to restore user balances.

Trading and deposit services resumed within hours, though withdrawals remained suspended pending additional security upgrades. The exchange emphasized that no user funds would be permanently lost due to the incident.

The hack sparked controversy when blockchain investigator ZachXBT accused BigONE of processing funds from romance scams and “pig butchering” operations. ZachXBT claimed that BigONE processed at least $60 million in scam-related funds through a single deposit address over seven months, including funds from pig butchering, romance, and investment scams.

The investigator stated he “did not feel bad for the team” because of the exchange’s alleged role in facilitating fraud schemes. ZachXBT also claimed another BigONE address received $4.5 million in similar scam proceeds in the week leading up to the hack.

BigONE responded by saying it had frozen some stolen funds and was cooperating with law enforcement, though it didn’t specify which agencies. The exchange disputed the allegations but didn’t provide detailed responses to the specific claims.

The BigONE incident adds to a concerning trend in cryptocurrency security breaches. According to TRM Labs, nearly $2.1 billion was stolen across 75 incidents in the first half of 2025, already exceeding the $1.8 billion lost in all of 2024.

Private key compromises accounted for 43.8% of stolen cryptocurrency in 2024, according to Chainalysis. However, the BigONE attack represents a shift toward more sophisticated backend infrastructure attacks that bypass traditional wallet security measures.

The crypto industry has seen several major breaches recently, including a February 2025 Bybit hack that resulted in $1.46 billion in losses and Iran’s Nobitex exchange losing $90 million in June 2025.

BigONE was founded in 2017 and is registered in Seychelles, supporting 265 cryptocurrency assets and 328 trading pairs. The exchange ranks 25th globally by trading volume and processed $16.6 billion in trades over the past 30 days.

The company operates across multiple countries including Singapore, Hong Kong, Brazil, Vietnam, Japan, and Indonesia. Despite its global reach, BigONE has maintained a relatively low profile compared to larger exchanges like Binance or Coinbase.

The exchange’s security incident highlights the ongoing challenges facing cryptocurrency platforms as they balance accessibility with protection against increasingly sophisticated cyber threats. While BigONE’s quick response and user compensation promise helped maintain confidence, the broader industry continues to grapple with billions in annual losses to hackers and scammers.