BigONE Exchange Loses $27M in Supply Chain Attack

BigONE Exchange, a major crypto trading platform, has confirmed a $27 million hack caused by a supply chain attack. The breach compromised part of the exchange’s production network.

Security firm SlowMist first reported the incident. Hackers altered the logic of BigONE’s account and risk management servers. This change allowed unauthorized fund withdrawals. Private keys were not leaked.

BigONE responded quickly. It confirmed that hot wallets were breached. However, the exchange stressed that private keys remain safe. In a public statement, BigONE said it will cover all user losses from the attack.

“We are tracking the attacker’s address and watching the movement of stolen funds. System recovery is underway,” the team shared.

Trading and recharge functions are temporarily paused. BigONE expects them to resume within hours.

The exchange’s fast response and full compensation pledge won praise. Many view it as a model of responsible crisis management in crypto.

Why It Matters

Hot wallets connect to the internet and are more vulnerable to hacks. In this case, the attacker bypassed internal controls by tampering with server-side logic. No private keys were exposed, but funds were still drained.

Experts say the breach shows the need for stronger backend security, not just wallet protection. Regular infrastructure audits and advanced monitoring tools are essential.

Users should also take precautions. Store large funds in cold wallets when possible. Always use two-factor authentication and strong, unique passwords.

This incident is a reminder. In crypto, infrastructure is as important as encryption.

Crypto Hacks Since 2024

Date	Target	Amount Stolen (approx.)	Details
Feb 2025	Bybit	$1.5 billion	Hack of Bybit’s cold wallet, attributed to North Korea’s Lazarus Group (“TraderTraitor”) [oai_citation:0‡Fintech Singapore](https://fintechnews.sg/108259/crypto/biggest-crypto-hacks-digital-security/?utm_source=chatgpt.com)
May 31, 2024	DMM Bitcoin	$300–$308 million	Private key compromise in custody partner Ginco; FBI suspects Lazarus Group ()
July 18, 2024	WazirX	$234.9–235 million	Multisig wallet exploit via fake smart contract; North Korean actors implicated ()
Feb 2024	PlayDapp	$290 million	Smart-contract mint exploit yielding 1.79 bn PLA tokens; ~\$290M loss ()
Early 2024 (Q1)	Orbit Chain	$80–100 million	Cross‑chain bridge hack; funds laundered via Tornado Cash ()