BigOne Crypto Exchange Hack: Supply Chain Attack Reveals CEX Security Flaws

A recent security breach at the BigOne cryptocurrency exchange, resulting in a reported loss of $27 million, underscores the persistent vulnerabilities within the centralized digital asset ecosystem. This incident, affecting hot wallets across prominent blockchains including Ethereum, Solana, Bitcoin, and TRON, highlights the evolving sophistication of cyber threats targeting trading platforms and the critical need for robust defense mechanisms beyond traditional private key security.

• BigOne exchange suffered a $27 million security breach on July 16, 2025.
• The incident was a “supply chain attack” that compromised the exchange’s operational infrastructure, not individual private keys.
• Assets were illicitly withdrawn from hot wallets across Ethereum, Solana, Bitcoin, and TRON networks.
• BigOne, ranked 91st globally by CoinGecko, pledged to cover all losses from its $91 million insurance fund.
• The breach signifies a shift in attack vectors, focusing on manipulating core exchange functionalities rather than direct key theft.

The exploit, which occurred on July 16, 2025, was not a result of compromised private keys but rather an insidious attack on the exchange’s operational infrastructure. According to the blockchain security firm SlowMist, this was a “supply chain attack” where the production network was infiltrated, and the operating logic of account and risk control-related servers was modified. This critical breach allowed the attacker to bypass standard withdrawal controls and perform unauthorized transactions, effectively enabling the withdrawal of an unlimited balance. This method signifies a concerning shift in attack vectors, moving beyond direct wallet key theft to more sophisticated manipulation of core exchange functionalities.

BigOne’s Response and Market Position

BigOne, currently ranked 91st globally by CoinGecko’s reliability index with a trust score of 6/10, promptly acknowledged the suspicious outflows from its primary hot wallet. The exchange affirmed that user assets remained secure and pledged to cover all losses from its insurance fund, which backs its holdings of over $91 million in crypto assets as per DeFiLlama data. Despite its relatively high trading volumes, BigOne has been noted for limited liquidity in certain trading pairs, potentially leading to significant slippage for traders. Furthermore, on-chain investigator ZachXBT previously indicated that the platform has been utilized for laundering funds from personal scams, adding another layer of concern regarding its operational integrity.

The attacker’s haul was substantial, including approximately 120 BTC, nearly $4 million in ETH and various Ethereum-based tokens, stablecoins across multiple networks, as well as significant amounts of SHIB, DOGE, and an additional $7 million in TRX tokens on the TRON network. Established in 2017, BigOne has navigated several volatile market cycles and adapted to regulatory shifts, notably relocating from mainland China. Its long-standing presence, however, means its asset portfolio largely consists of altcoins from previous bull cycles, with comparatively less exposure to newer meme tokens.

Broader Implications for Centralized Exchanges

This incident represents a stark reminder of the persistent challenges facing centralized exchanges (CEXs) in maintaining robust security infrastructure. While decentralized protocols have frequently been targets of exploits, significant attacks on CEXs involving supply chain vulnerabilities have become less common since events like the KuCoin exploit in 2020, which resulted in losses of $275 million. Even more recent incidents, such as a Bybit attack, typically involved specific wallet vulnerabilities rather than a fundamental breach of core account and authorization infrastructure. The BigOne breach highlights that even with sophisticated wallet security measures in place, server-side vulnerabilities and manipulated operational logic present a potent and evolving threat, demanding continuous re-evaluation and reinforcement of security protocols across the entire industry. The ability of hackers to alter system logic and bypass withdrawal controls, even if transactions are subsequently flagged, underscores the increasing complexity of cyber defense in the dynamic digital asset landscape.