View source for BigONE Control Logic Changed To Withdraw Customer Funds

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bigonecontrollogicchangedtowithdrawcustomerfunds.php}}
{{Unattributed Sources}}

[[File:Bigoneexchange.jpg|thumb|BigONE Exchange Logo/Homepage]]BigONE Exchange is a full-featured cryptocurrency trading platform offering spot, margin, and futures trading, alongside structured investment products through its BigONE Earn suite. With a focus on user convenience, security, and education, it provides tools for both novice and experienced traders. Despite its robust infrastructure, BigONE recently suffered a security breach that compromised its production network and allowed unauthorized fund withdrawals—though private keys were not leaked. The exchange has acknowledged the incident, pledged to cover all user losses, and is working with blockchain security firm SlowMist to investigate and enhance system security. Withdrawals will resume following a full security review.<ref name="slowmistteamtweet-20571" /><ref name="bigonedisclosure-20572" /><ref name="blockchaincom-20573" /><ref name="etherscantheft-20574" /><ref name="bigonehomepage-20575" />

== About BigONE ==
BigONE Exchange is a comprehensive cryptocurrency trading platform that offers a wide range of financial products and services designed to support users at all stages of their crypto journey. Users can access spot and margin trading on over 500 cryptocurrencies, as well as futures contracts with up to 100x leverage. BigONE also provides a zero-fee conversion service for seamless trading across all pairs. The platform focuses on user convenience and aims to empower investors by offering easy-to-use tools for both beginners and experienced traders.

The platform’s financial suite, BigONE Earn, includes structured investment products such as dual investment strategies, capital-guaranteed products, and options to buy discounted crypto assets. These are designed to maximize yields while managing risk, offering users stable returns with flexible investment strategies. BigONE emphasizes secure and efficient investing, providing users with a robust system to navigate the fast-paced crypto market with confidence.

Beyond trading, BigONE fosters community engagement and education through its customer support, global investor community, and BigONEpedia, a knowledge hub with expert insights into the crypto industry. The BigONE mobile app enhances accessibility, allowing users to manage their investments and stay informed on the go. With security features like penetration testing, bug bounty programs, and proof of funds verification, BigONE positions itself as a secure, user-focused platform for crypto wealth building.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
BigONE Exchange experienced a security breach that allowed attackers to withdraw funds by modifying server logic.
{| class="wikitable"
|+Key Event Timeline - BigONE Control Logic Changed To Withdraw Customer Funds
!Date
!Event
!Description
|-
|July 15th, 2025 11:24:57 AM MDT
|Bitcoin Theft Transaction
|The first theft of 35 BTC from the BigONE exchange.
|-
|July 15th, 2025 11:24:59 AM MDT
|Ethereum Theft Transaction
|The theft of 350 ETH from the BigONE exchange.
|-
|July 15th, 2025 10:56:00 PM MDT
|SlowMist Tweet
|SlowMist shares a tweet of the incident.
|}

== Technical Details ==
"The production network was compromised, and the operating logic of account and risk control related servers was modified, enabling the attacker to withdraw funds. Notably, the private keys were not leaked."

Hacker addresses:
Ethereum & BSC0x9Bf7a4dDcA405929dba1FBB136F764F5892A8a7a
Solana: HSr1FNv266zCnVtUdZhfYrhgWx1a4LNEpMPDymQzPg4R
Bitcoin: bc1qwxm53zya6cuflxhcxy84t4c4wrmgrwqzd07jxm
Tron: TKKGH8bwmEEvyp3QkzDCbK61EwCHXdo17c

== Total Amount Lost ==
BTC                       120

ETH                       350

USDT(TRC20)      6,974,358

USDT(ERC20)       1,395,000

USDT(BSC)           38,106.95

USDT(SOL)           134,764

XIN                         20,730

SNT                        4,369,581

WBTC                     1

CELR                       15,772,006

LEO                         16,071

UNI                          25,487

SHIB                        9,697,050,027

SOL                         1,800

DOGE                      538,000

The total amount lost has been estimated at $27,000,000 USD.

== Immediate Reactions ==
The exchange publicly acknowledged the theft and has stated they will be covering all related losses.

== Ultimate Outcome ==
BigONE engaged SlowMist to assist with security, who also publicly reported on the situation.

== Total Amount Recovered ==
The platform has offered to cover all assets of affected users.

The total amount recovered has been estimated at $27,000,000 USD.

== Ongoing Developments ==
Assets are currently being tracked down. The platform has promised that withdrawals will be reopened after a security check is completed.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmistteamtweet-20571">[https://twitter.com/SlowMist_Team/status/1945346830222680330 SlowMist - "The exchange @BigONEexchange was exploited due to a supply chain attack and loss exceeds $27 million. The production network was compromised, and the operating logic of account and risk control related servers was modified, enabling the attacker to withdraw funds. Notably, the private keys were not leaked." - Twitter/X] (Accessed Jul 16, 2025)</ref>

<ref name="bigonedisclosure-20572">[https://bigone.zendesk.com/hc/en-us/articles/48916067512345-BigONE-Security-Incident-Disclosure-and-Progress-Update-July-16 BigONE Security Incident Disclosure and Progress Update – July 16 - BigONE] (Accessed Jul 16, 2025)</ref>

<ref name="blockchaincom-20573">[https://www.blockchain.com/explorer/addresses/btc/bc1qwxm53zya6cuflxhcxy84t4c4wrmgrwqzd07jxm Bitcoin Theft Address - BlockChain.com] (Accessed Jul 16, 2025)</ref>

<ref name="etherscantheft-20574">[https://etherscan.io/tx/0xb781d8504a6a6fa3364eeea8ae76df12f434f64c99c109766dd4e04ae6f32d06 Ethereum Theft Transaction - Etherscan] (Accessed Jul 16, 2025)</ref>

<ref name="bigonehomepage-20575">[https://www.b1.zone/en BigONE Homepage] (Accessed Jul 16, 2025)</ref></references>