BigONE hack — July 2025

BigONE, a centralised cryptocurrency exchange, lost about $27 million in the early hours of 16 July 2025 when attackers reached its production infrastructure rather than its keys.

The exchange said it detected abnormal movements involving a portion of platform assets and confirmed these were the result of a third-party attack. According to BigONE and the security firm SlowMist, which the exchange engaged to trace the funds, the intrusion was a supply-chain compromise: the attackers obtained access to BigONE's backend build and deployment environment and altered the operating logic of its account, accounting and risk-management services, which allowed withdrawals to be authorised through the exchange's own systems. Both BigONE and SlowMist stated that private keys remained secure and that the attack path was identified and contained without further loss. Cointelegraph reported that the entry point was a socially engineered compromise of a developer's device.

Reported asset breakdowns differ slightly between outlets: roughly 120 to 121 BTC, 350 ETH, 1,800 SOL, several million dollars of USDT, between about 9.5 and 9.7 billion SHIB, 538,000 DOGE, and smaller amounts of UNI, CELR, LEO and XIN. The holdings spanned Bitcoin, Ethereum, BNB Chain, Tron and Solana, and the stolen assets were swapped and moved cross-chain shortly after the theft.

BigONE suspended deposits and withdrawals, stating that all user assets were safe and that it would bear the losses in full using internal reserves and borrowing to replace tokens it did not hold in sufficient quantity. Trading and deposits resumed first, and the exchange later announced that withdrawals had been fully restored. It also offered a bounty of up to $8 million for information identifying the attackers. No attribution has been published and no recovery has been reported.