Key Takeaways:
- Hackers stolen over $27 million worth of crypto assets from BigONE’s hot wallet through a security breach in its account logic rather than private keys.
- The cyberattack was confirmed to be a manipulation of withdrawal logic as server operations were altered, deploying “unauthorized withdrawals” without the need of private keys.
- Crypto funds stolen are quickly split and converted, mainly including BTC, TRX, ETH, and SOL.
What the Hack Happened?
Crypto exchange BigONE detected unusual fund movements in its hot wallet, later confirming a massive breach reaching over $27 million of crypto assets. SlowMist, a blockchain security firm, flagged the supply-chain attack where the hackers altered BigONE’s production server logic instead of private keys to take control of the massive amount of withdrawals, mainly manipulating the account and risk control systems.
The attacker is already moving funds swapping into TRX, BTC, ETH & SOL.” noted by Wise Advise on their post in X. “BigONE says they will cover all user losses.” they added.
Meanwhile, the data provided by Lookonchain shows the split and conversion of funds made by the hacker, moving 120 Bitcoin worth $14.15 million, 23.3 million Tron worth $7 million, 1,272 ETH worth $4 million, and 2,625 Solana worth $430,000., according to a Cryptonews report.
After suffering major loss, the infiltrated crypto exchange urgently disabled trading, deposits, and withdrawal processes, and sought help from blockchain security firms Slowmist and Certik for a fund tracing. At the same time, they activated their on-chain reserves and borrowed liquidity to ensure no implication to users’ funds.
Security alerts from SlowMist noted:
The operating logic of account and risk control related servers was modified, enabling the attacker to withdraw funds.
However, CertiK emphasized on their post in X that affected funds “may not be liquidatable”, pointing out that the hackers might struggle to profit from their exfiltration.
Concurrently, BigONE declared that they will fully recover all losses incurred from this incident, according to their announcement on their official website.
“BigONE will fully cover all losses incurred from this incident. User assets will not be affected in any material way.” as they noted.
Price and Market Impact
As of writing, price action, particularly in BTC and ETH remained steady following the massive breach to BigONE, without any signs of neither panic selling nor significant rally. The unnoticeable market reaction so far demonstrates how the traders interpret this incident as isolated case to the exchange, rather than an affecting factor to the market. Bitcoin as of July 16, 2025, 7:00 AM UTC plays at around $118,700 (+2.05%), reclaiming its early losses after a cooling-off breakdown post-ATH. Ethereum on the other hand shows an observable increase, ranging approximately $3,150 (+3.50%).
On-chain tracker PeckShieldAlert signaled potential short-term volatility in TRX, SOL, and BNB as a possible result of the stolen funds’ diversion. However, these altcoins have shown little to no signs of significant movement beyond typical intra-day swings. This suggests strong momentum following the signs of alt-season emergence.
Summary
A major exploit hit crypto exchange BigONE, where over $27 million was drained from its hot wallet due to a supply-chain style attack. Instead of private keys, hackers manipulated server-side withdrawal logic to execute unauthorized fund movements, affecting assets like BTC, ETH, TRX, and SOL. BigONE disabled trading and sought help from SlowMist and CertiK to trace the funds. Despite the breach, BTC and ETH prices remained stable, showing investor confidence. BigONE committed to reimbursing users fully.
