The BigONE Hack Explained: $27M, No Keys Leaked
Quick answer. In July 2025, about $27 million left BigONE's hot wallet, BigONE estimated. SlowMist says a supply chain attack altered its account and risk-control servers, and no keys leaked. The check: can production systems be altered to approve withdrawals?
Video transcript
In July 2025, about 27 million dollars left BigONE's hot wallet, and no private keys leaked. The weak point was the systems that approve withdrawals.
BigONE estimated about 27 million dollars. SlowMist said the loss exceeded that, and Blockscope's first assessment put it above 28 million.
On July 15, BigONE posted a maintenance notice, then reported a third-party attack and froze withdrawals and trading. It disclosed the loss the next morning, pledged to cover it, and fully restored withdrawals by July 18.
SlowMist blamed a supply chain attack that compromised the production network and modified account and risk-control servers. Neither firm named the supplier.
A hot wallet signs whatever its own systems approve. Change that logic, and withdrawals go through without a stolen key.
These are lessons, not findings of fault. Test the approval path as hard as the key store. Protect risk controls from being rewritten. Treat the supply chain as part of production. And watch outflows from outside.
Guardian's Infrastructure Pentest covers this layer. It escalates like an intruder through build and deploy pipelines, containers and clusters, vendor consoles and cloud posture, until something signs.
Read the full article for the timeline and drained assets. Or talk to Guardian about testing the systems that approve your withdrawals.
The BigONE hack is a case where the keys held and the money left anyway. BigONE and SlowMist both say no private keys leaked.
Instead, SlowMist says, the attacker modified the logic of BigONE's account and risk-control servers. That let the withdrawals go through.
That puts the weak point in production infrastructure, not in a contract or a key store. Here is what BigONE and investigators reported.
What Happened
BigONE is a Seychelles-based exchange, originally founded in China in 2017, The Block reported.
At 19:13 UTC on July 15, 2025, BigONE posted a notice that all of its services were under system maintenance.
A second notice, logged at 22:53 UTC, said it had detected abnormal asset transfers caused by a third-party attack. It suspended all deposits, withdrawals and trading.
The affected assets came from its hot wallet, that notice said, and "all wallet private keys remain secure."
At 04:00 UTC on July 16, BigONE published a fuller disclosure. It said:
- A third-party attack targeted its hot wallet.
- The attack path was identified and contained.
- The estimated loss was about $27 million.
- It was working with SlowMist to trace the funds.
- It would fully cover all losses.
How the Attack Worked
SlowMist gave the main technical account. Its alert at 04:56 UTC on July 16 said BigONE "was exploited due to a supply chain attack."
In SlowMist's words, "the production network was compromised, and the operating logic of account and risk control related servers was modified." That enabled the attacker to withdraw funds.
"Notably, the private keys were not leaked," SlowMist added.
Later on July 16, BigONE said it had "identified the method of attack" and addressed "the related vulnerabilities."
In the statements reviewed here, neither BigONE nor SlowMist named the compromised supplier or component.
Why no key was needed
An exchange hot wallet signs the withdrawals its own systems approve. Account balances and risk checks decide what gets approved.
If that logic is changed, withdrawals can go through without any key being stolen. That matches SlowMist's account.
Timeline and Loss
Times are UTC, as logged by X and by BigONE's help center.
| Time (UTC) | Event | Source |
|---|---|---|
| Jul 15, 19:13 | Notice: all services under maintenance | BigONE |
| Jul 15, 22:53 | Third-party attack; deposits, withdrawals and trading suspended | BigONE |
| Jul 16, 04:00 | Disclosure: hot wallet attacked, about $27M, keys secure | BigONE |
| 04:21 | Large outflows flagged; exploiter holds about $4M | CertiK |
| 04:56 | Supply chain attack; servers modified; loss over $27M | SlowMist |
| 06:25 | Initial assessment: over $28M across five chains | Blockscope |
| 07:34 | Attack method identified; services to resume in stages | BigONE |
| Jul 18, 07:34 | Withdrawals restored for Earn products | BigONE |
| 12:00 | Withdrawals fully restored | BigONE |
How much was taken
BigONE estimated the loss at about $27 million. SlowMist said it exceeded $27 million, and Blockscope's initial assessment put it above $28 million.
BigONE's disclosure listed the drained assets:
| Asset | Amount, per BigONE |
|---|---|
| BTC | 120 |
| ETH | 350 |
| USDT | About 8.54M across TRON, Ethereum, BSC and Solana |
| SOL | 1,800 |
| DOGE | 538,000 |
| SHIB | About 9.70B |
| CELR | About 15.77M |
| Others | XIN, SNT, WBTC, LEO and UNI |
By chain, Blockscope estimated Bitcoin at about $14M, Ethereum about $8M and TRON about $7M. Solana was about $420K and BSC about $106K.
Lookonchain reported that the attacker had swapped the haul into 120 BTC, 23.316M TRX, 1,272 ETH and 2,625 SOL.
Compensation
BigONE said it would cover all losses. It drew on internal reserves of BTC, ETH, USDT, SOL and XIN, and sought borrowed liquidity for other tokens.
"User assets will not be affected in any material way," it said.
Deposits and trading returned on July 16. Withdrawals were fully restored on July 18.
What It Shows
The statements reviewed here do not include a full post-mortem. These are lessons from the facts above, not findings of fault.
Secure keys are not secure funds
By both accounts, key custody held. The controls in front of the keys did not. Test the approval path as hard as the key store.
Risk controls need their own protection
Risk checks that an attacker can rewrite stop being checks. A signer that re-checks policy on its own is one defense; see exchange withdrawal security controls.
The supply chain reaches production
A compromised dependency, build or vendor can change the code that moves money. For a CI example, see the tj-actions/changed-files compromise.
Watch outflows from outside
Set hot wallet limits and alerts outside the systems that approve withdrawals, so the alarm does not depend on a server an attacker can rewrite. See hot wallet monitoring.
How Infrastructure Pentest Tests This
Guardian's Infrastructure Pentest covers the layer this attack hit: "the servers, accounts, and vendors your protocol depends on."
The premise is that "contracts run on infrastructure, and infrastructure runs on credentials." Guardian escalates through your cloud accounts like an intruder, until something signs.
The areas closest to BigONE's breach, as the service page describes them:
- Build and deploy: CI/CD runner permissions, artifact integrity, and whether a compromised pipeline can ship or sign.
- Containers and clusters: what is baked into images, and whether one pod reaches the rest of the cluster.
- Vendor consoles: SaaS accounts that can change production, like source control, CDN and identity.
- Cloud posture: IAM and trust policies, and what one stolen key unlocks.
It covers AWS, GCP and Azure plus platforms such as GitHub, CI, Docker, Kubernetes and Terraform. It is scoped by the cloud accounts and platforms in play.
For exchanges, it sits beside the app and API work in a crypto exchange pentest. See the Infrastructure Pentest page.
Frequently Asked Questions
How much was lost in the BigONE hack?
BigONE estimated about $27 million. SlowMist said the loss exceeded $27 million, and Blockscope's initial assessment put it above $28 million across Bitcoin, Ethereum, TRON, BSC and Solana.
Were BigONE's private keys stolen?
No, according to BigONE and SlowMist. SlowMist says the attacker compromised the production network and modified the logic of account and risk-control servers, which let the withdrawals go through.
What was the supply chain attack at BigONE?
SlowMist attributed the breach to a supply chain attack. In the statements reviewed here, neither SlowMist nor BigONE named the compromised supplier, package or component.
Did BigONE users lose money?
BigONE said it would fully cover all losses, using reserves of BTC, ETH, USDT, SOL and XIN plus borrowing for other tokens. It said user assets would not be affected in any material way.
Sources
- BigONE: Announcement on System Upgrade Maintenance (July 15, 2025, UTC)
- BigONE: Announcement Regarding BigONE Security Incident on 16 July 2025 (July 15, 2025, UTC)
- BigONE: Security Incident Disclosure and Progress Update (July 16, 2025)
- BigONE: Announcement on BigONE System Maintenance Update (July 16, 2025)
- BigONE: System Upgrade and Maintenance Completed (July 16, 2025)
- BigONE: Withdrawal for BigONE Earn Products Has Been Resumed (July 18, 2025)
- BigONE: Withdrawal Services Fully Restored (July 18, 2025)
- BigONE on X: Security incident, unauthorized access to our hot wallet (July 16, 2025)
- SlowMist on X: Threat intelligence alert on BigONE (July 16, 2025)
- CertiK Alert on X: Outflows related to the BigONE incident (July 16, 2025)
- Blockscope on X: Initial assessment of the BigONE exploit (July 16, 2025)
- Lookonchain on X: BigONE hacker's swapped assets (July 16, 2025)
- The Block: Crypto exchange BigONE hacked for over $27 million in hot wallet exploit (July 16, 2025)
- Rekt: BigONE, Rekt (July 18, 2025)
Test the systems that approve withdrawals
Guardian's Infrastructure Pentest attacks your pipelines, clusters and vendor consoles the way an intruder escalates toward something that signs.