Could the BigONE $27M Breach Signal a Larger Threat to Crypto Assets?

TLDR

Table of Contents

BigONE lost over $27M in crypto after attackers altered internal server logic in a supply chain breach.
121 BTC, 350 ETH, 9.69B SHIB, and 8.54M USDT were stolen from BigONE’s hot wallets on July 16, 2025.
BigONE confirmed private keys were not leaked and promised full user compensation using internal reserves.
Blockchain firm SlowMist is helping BigONE trace stolen funds and monitor hacker wallet activity.

Crypto exchange BigONE has become the latest target of a major security breach, with attackers stealing over $27 million in digital assets. The exploit, discovered in the early hours of July 16, 2025, involved unauthorized withdrawals from the exchange’s hot wallets. The stolen assets included popular tokens such as Bitcoin (BTC), Ethereum (ETH), Tether (USDT), Shiba Inu (SHIB), and Solana (SOL).

The incident is being investigated as a supply chain attack, with early findings indicating that the exchange’s internal systems were compromised. While BigONE stated that no private keys were exposed, the breach raises new questions about the safety of crypto platforms.

BigONE Becomes Latest Target in Crypto Exchange Breach

BigONE confirmed that a third-party security breach led to unauthorized access to its production network. Hackers altered the internal server logic responsible for managing accounts and risk control processes. This allowed them to bypass normal security checks and withdraw funds without triggering alarms.

According to blockchain security firm SlowMist, which is assisting with the investigation, the attackers modified system behavior without directly accessing private keys. “The operating logic of account and risk control related servers was modified,” the firm reported via X. This tactic reflects a growing trend in crypto exploits where attackers manipulate internal infrastructure rather than breaching wallet keys.

The assets lost include 121 BTC, 350 ETH, 8.54 million USDT, 9.69 billion SHIB, 1,800 SOL, and smaller amounts of DOGE and other tokens. The hackers quickly moved and split these assets across multiple wallets. Data from Lookonchain showed transactions involving over 23 million TRX, 1,272 ETH, and 120 BTC shortly after the attack.

Details of the $27 Million Digital Asset Theft

BigONE stated that it detected “abnormal movements” from its hot wallets during the early morning hours of July 16. Following an internal check, the exchange confirmed the losses and suspended deposits and withdrawals to contain the situation.

In an official statement, BigONE said, “All user assets are safe. BigONE will fully bear all the losses. Trading and deposits will resume soon.” Withdrawal functions will be restored once additional security measures are in place. The company emphasized that its cold wallets and private keys were not affected.

CertiK Alert and other blockchain monitoring services have tracked ongoing movement of the stolen funds. As of now, the attacker still holds around $4 million in ETH and other tokens. These are being tracked for potential recovery, though some assets may have already been exchanged into different coins or platforms.

BigONE also reported that it has activated its internal security reserve, which holds assets like BTC, ETH, XIN, SOL, and USDT. These funds will be used to compensate users whose assets were affected during the breach.

Security Response and Recovery Measures

BigONE’s immediate response included halting all platform withdrawals and working with SlowMist to analyze the breach. The company traced the vulnerability to a supply chain attack, which targeted backend systems that manage account access and trading risk.

The exchange confirmed that the attack path has been neutralized and that systems have been updated to prevent repeat breaches of the same kind. BigONE is also securing external liquidity to support token replacement for both mainstream and low-liquidity tokens.

Moving forward, BigONE has announced plans to implement new security protocols across its infrastructure. These include improved server isolation, enhanced monitoring tools, and stricter controls over internal code deployments. Trading and deposit services are expected to resume within hours, while withdrawals will remain paused until all security upgrades are complete.

Stay Ahead of the Market with Benzinga Pro!

Want to trade like a pro? Benzinga Pro gives you the edge you need in today's fast-paced markets. Get real-time news, exclusive insights, and powerful tools trusted by professional traders: