# BigONE

Date:: 2025-07-15

Time:: 17:14–19:51 UTC (Tuesday)

Time:: 02:14–04:51 KST (Wednesday)

Amount Stolen: $27,000,000

Tags:: 👛


---


## Details

The exchange BigONEexchange was exploited due to a supply chain attack and loss exceeds $27 million.

The production network was compromised, and the operating logic of account and risk control related servers was modified, enabling the attacker to withdraw funds. Notably, the private keys were not leaked.

In the early hours of July 16, BigONE detected abnormal movements involving a portion of the platform’s assets. Upon investigation, it was confirmed to be the result of a third-party attack targeting our hot wallet. Below is the current progress of the situation:

All private keys remain secure. The attack path has been identified and contained, ensuring no further losses will occur.

In July 2025, BigONE suffered a major security incident. Third-party attackers used highly sophisticated social engineering techniques to compromise the development device of a key developer, thereby gaining unauthorized access and permissions. 

The attackers subsequently carried out a coordinated supply chain attack by deploying tampered code through version deployment service providers. 

This allowed them to temporarily alter the logic of specific accounting and risk management services within the platform, ultimately resulting in the unauthorized transfer of approximately USD 27 million worth of cryptocurrencies from one of BigONE’s hot wallets. 

The compromised assets included tokens from major public blockchains, including Bitcoin, Ethereum, Solana, Dogecoin, and Tron. 

Note: Preliminary investigation has confirmed the full attack path and logic. Following system reinforcement and post-accident updates, no further losses are expected. 

All BigONE wallet private keys and user data remain secure, with losses limited to a portion of assets from the targeted hot wallet. 


## Further Reading

- https://quadrigainitiative.com/casestudy/bigonecontrollogicchangedtowithdrawcustomerfunds.php

- https://bigone.zendesk.com/hc/en-us/articles/48916067512345-BigONE-Security-Incident-Disclosure-and-Progress-Update-July-16

- https://x.com/SlowMist_Team/status/1945346830222680330

- https://hackenproof.com/programs/bigone-hack-bounty-program

- Attributed in [MSMT: The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities](./pdfs/2025-10-22_MSMT-Report.pdf)



## Amount Stolen


- TRX - 2025-07-15 17:14-18:56

- ETH - 2025-07-15 17:24-19:51

- BTC - 2025-07-15 17:27-17:58


- BTC         120
- ETH         350
- USDT(TRC20) 6,974,358
- USDT(ERC20) 1,395,000
- USDT(BSC)   38,106.95
- USDT(SOL)   134,764
- XIN         20,730
- SNT         4,369,581
- WBTC        1
- CELR        15,772,006
- LEO         16,071
- UNI         25,487
- SHIB        9,697,050,027
- SOL         1,800
- DOGE        538,000



## Onchain


- HSr1FNv266zCnVtUdZhfYrhgWx1a4LNEpMPDymQzPg4R - Direct Theft / Swap (SOL)

- TKKGH8bwmEEvyp3QkzDCbK61EwCHXdo17c           - Direct Theft / Swap (TRX)

- 0x9Bf7a4dDcA405929dba1FBB136F764F5892A8a7a   - Direct Theft / Swap (ETH + BSC)

- bc1qwxm53zya6cuflxhcxy84t4c4wrmgrwqzd07jxm   - Direct Theft / Funds Holder (120 BTC)

- 7RWHQ7ujSFwokAPkAhHTdiPxRF2LmqrvgYEqDiAjLxdH - Initital Theft / Funds Holder (2,625 SOL)

- TCAfB8jHbJ56xwmfwKwWEs8HLRjbC2GfHG           - Initital Theft / Funds Holder (23,316,224 TRX)

- 0x0a360bd648eb86613961a2aa41dc1610c5305f4f   - Initital Theft / Funds Holder (1,271.5 ETH + 12,009.9743 XIN)




## Indicators

- 192.166.246.84

- 94.156.148.191

- 91.214.65.209

- 37.120.197.197

- 45.86.163.132

- 103.214.46.201

- 45.84.139.168

- 62.3.36.62        

- 194.35.235.127   

- 86.104.21.176

- 45.84.137.xxx

- (Nord VPN)