BigONE, the Seychelles-based cryptocurrency exchange, reported a hack that occurred on July 16, 2025, leading to a loss of $27 million from its hot wallets. The attack was preceded by sophisticated social engineering tactics.
How the BigONE Crypto Exchange Hack Happened
The attack on BigONE consisted of two stages: the first involved the use of social engineering methods to compromise the device of a key exchange developer. The second stage was a sophisticated supply chain attack that enabled unauthorized changes to the accounting and risk management logic within the exchange infrastructure. As a result, $27 million in cryptocurrency was withdrawn from hot wallets. Confirming the attackers' access, BigONE reported: 'In the early hours of July 16, we detected abnormal movements involving a portion of platform assets, which turned out to be the result of a third-party attack targeting our hot wallet.'
Tracing the Stolen Funds from the BigONE Hack
The investigation is being aided by the security company SlowMist, known for its security audits and attack analysis. According to reports, the attackers began laundering the stolen assets through various cryptocurrencies. Analysis showed that funds were laundered through blockchains such as Tron, Solana, Ethereum, and Bitcoin. To assist in the investigation, BigONE established a bounty program for information regarding the stolen funds.
New Attack Vulnerabilities and Prevention
This incident weakens the trust users place in centralized exchanges. The focus is now on the necessity to secure not just private keys but also internal infrastructure. Developments in this area are becoming increasingly complex, and cases like BigONE highlight the importance of comprehensive security. Exchanges need to implement tiered security systems to prevent the compromise of a single point of failure, such as a developer.
The BigONE hack, resulting in a loss of $27 million, serves as a stark example of the security shortcomings present in centralized cryptocurrency exchanges. It emphasizes the need for tighter controls and protections for internal infrastructures to prevent similar incidents in the future.
