BigONE Exchange Hit by Supply Chain Attack, Loses Over $27 Million

Highlights:

• BigONE lost $27 million in a hack after attackers bypassed server security controls.
• Exchange promises to cover all losses and confirms user assets remain fully safe.
• Hackers moved stolen crypto through new wallets, likely to hide funds or sell.

Crypto exchange BigONE confirmed on Wednesday that it had become the target of a third-party attack, which resulted in estimated losses of around $27 million. According to initial reports, the attackers found a weakness in BigONE’s supply chain. They allegedly tampered with the server logic used by the platform. This manipulation of the system allowed them to bypass normal controls and perform unauthorized fund withdrawals. The incident has raised serious concerns about the security of the platform’s infrastructure.

🚨SlowMist TI Alert🚨

The exchange @BigONEexchange was exploited due to a supply chain attack and loss exceeds $27 million. The production network was compromised, and the operating logic of account and risk control related servers was modified, enabling the attacker to withdraw… pic.twitter.com/GkxlNIUs6A

— SlowMist (@SlowMist_Team) July 16, 2025

BigONE Vows to Cover $27M Hack Losses, Assures User Funds Are Safe

BigONE later acknowledged the incident and assured its users that their private keys were not compromised and all user assets remain secure. The exchange emphasized that it will take full responsibility for the losses caused by the attack. “All user assets are safe. BigONE will fully bear all the losses. Trading and deposits will resume soon; withdrawals after added security upgrades,” the exchange noted.

The platform teamed up with blockchain security company SlowMist to identify the hacker’s wallet addresses and closely track the movement of the stolen assets. The stolen funds include Bitcoin, Ether, and millions of Tether (USDT). In addition, a large number of other tokens were also taken, including CELR, SNT, SHIB, and several others involved in the attack.

BigONE has promised to fully cover all losses from the recent attack to protect user funds. The exchange said it has already started using its own internal security reserves, which include Bitcoin, Ethereum, Tether (USDT), Solana (SOL), and Mixin (XIN), to replace the stolen assets and keep users safe. For other major and minor tokens that were affected, BigONE said it is now working to arrange outside liquidity through borrowing. This will help the platform restore its wallet balances and resume normal operations as soon as possible.

⚠️ Security Incident: unauthorized access to our hot wallet

All user assets are safe. BigONE will fully bear all the losses. Trading and deposits will resume soon; withdrawals after added security upgrades.

🔗 https://t.co/CWCrng2KK8

— BigONE (@BigONEexchange) July 16, 2025

BigONE Hackers Move Funds Through New Wallets

A blockchain security group noted that the attacker began moving the stolen crypto soon after the breach, converting it into assets like TRX, ETH, BTC, and SOL. Lookonchain data shows the hacker quickly split and routed 120 BTC worth $14.15 million, 23.31 million TRX valued at $7.01 million, 1,272 ETH worth roughly $4 million, and 2,625 SOL estimated at $428,000, across several addresses.

#CertiKInsight 🚨

We have seen multiple large token outflows from 0xd4dcd2459bb78d7a645aa7e196857d421b10d93f that are related to the latest BigONE security incident.

The exploiter now holds ~$4M in ETH and multiple other tokens (may not be liquidatable ) at… pic.twitter.com/qWM0rFfNbB

— CertiK Alert (@CertiKAlert) July 16, 2025

The recent unauthorized withdrawal stands as the most serious security breach BigONE has ever faced. According to CoinGecko’s reliability index, the exchange holds the 91st position with a trust score of 6 out of 10. While BigONE handles relatively high trading volumes, some of its pairs still suffer from low liquidity, increasing the chances of slippage during trades. One day before the BigONE hack, Arcadia Finance was also attacked. The DeFi platform lost about $3.5 million in crypto.