BigONE Exchange under fire for persisting with scam activities for months, according to ZachXBT's harsh criticism.
In a shocking turn of events, centralized crypto exchange BigONE fell victim to a sophisticated supply chain attack on July 16, 2025. Estimated losses amount to a staggering $27 million, making it one of the most significant hacks in the crypto industry this year.
The attack targeted BigONE's hot wallet infrastructure, compromising third-party software or services linked to the exchange. By manipulating server-side business logic, the attackers were able to bypass internal account and risk controls, enabling unauthorized withdrawals without exposing private keys.
Following the breach, BigONE took immediate action by pausing trading and deposit functions and pledged to fully cover all user losses using its internal security reserves and external liquidity borrowing. The stolen cryptocurrencies included Bitcoin (BTC), Ether (ETH), Tron (TRX), Solana (SOL), USD Tether (USDT), and various other tokens, with withdrawals spanning multiple blockchains and the funds quickly consolidated for laundering.
Onchain investigator ZachXBT publicly accused BigONE of facilitating illicit activities prior to the hack, stating that the exchange had processed significant volumes related to scams such as pig butchering, romance scams, and fake investment schemes. Due to this, ZachXBT expressed a lack of sympathy for BigONE’s losses, framing the hack within a broader context of questionable exchange practices.
BigONE has cooperated with blockchain security firm SlowMist to track the attacker's addresses and monitor fund movements. However, as of press time, BigONE has not publicly addressed ZachXBT's claims.
Investigations into the hack are ongoing, but concrete details about law enforcement actions have not been reported yet. The scale and public nature of the hack suggest that investigations are underway or will commence soon.
This scandal underscores the ongoing challenges crypto exchanges face with supply chain vulnerabilities and the importance of robust security practices, including CI/CD pipeline protection and real-time monitoring, to prevent such breaches. The role of public blockchain sleuths like ZachXBT also underscores the interplay between cybersecurity, transparency, and ethical scrutiny in the cryptocurrency ecosystem.
Key points summary:
| Aspect | Details | |------------------------------------|------------------------------------------------------------------------------------------------| | Incident Date | July 16, 2025 | | Attack Type | Supply chain attack compromising third-party software and server logic | | Amount Stolen | Approximately $27 million | | Target | Hot wallet infrastructure | | Cryptocurrencies Stolen | BTC, ETH, TRX, SOL, USDT, XIN, SNT, CELR, LEO, UNI, SHIB, and others | | Exchange Response | Paused services, pledged to fully reimburse losses, activated internal reserves and external liquidity | | ZachXBT’s Accusations | BigONE processed significant volumes from scams (pig butchering, romance scams, investment scams) | | Law Enforcement Cooperation Status | Not explicitly reported, but BigONE is tracking attacker addresses |
- The sophisticated supply chain attack on BigONE's third-party software and server logic in the finance sector resulted in a loss of approximately $27 million, a significant hit within the technology-driven crypto industry this year.
- The compromised exchange, BigONE, also came under scrutiny for facilitating illicit activities such as scams, with public blockchain sleuth ZachXBT alleging they processed significant volumes related to pig butchering, romance scams, and fake investment schemes, raising questions about the exchange's practices within the realm of general-news and crime-and-justice.
