BigONE exchange hacked for $27 million

[TravelMug]

Dear Users,

In the early hours of July 16, BigONE detected abnormal movements involving a portion of the platform’s assets. Upon investigation, it was confirmed to be the result of a third-party attack targeting our hot wallet.

https://bigone.zendesk.com/hc/en-us/articles/48916067512345-BigONE-Security-Incident-Disclosure-and-Progress-Update-July-16

Anyone have use this cryptocurrency exchange? As it seems that it is the latest victim, a $27 million hack on their system. It's not that big as compare to other exchanges, but still the amount of money could be huge for them as I will admit that I haven't heard about this crypto exchanges before so they could be in the tier B or tier C. So the impact could be huge for them.

[un_rank]

I have never used them, but I hoped they could give more information on how the hack occurred without any private key breach. I also understand that giving detailed information can serve as a blue print for other scammers and make them a target.

From their X account, they are still yet to resume withdrawals but users can deposit and trade. I would have much preferred they first fix withdrawals before any thing else.

- Jay -

[PX-Z]

I have never used them, but I hoped they could give more information on how the hack occurred without any private key breach. I also understand that giving detailed information can serve as a blue print for other scammers and make them a target.

There's no detailed information available about this, and I doubt they'll release it publicly. As you mentioned, disclosing such info might give other hackers an opportunity to exploit it again, unless the vulnerability has already been fully patched.

On the bright side, the exchange has stated that they will fully cover all losses, so users shouldn't experience any loss of funds, just the temporary inconvenience.

[SFR10]

From their X account, they are still yet to resume withdrawals but users can deposit and trade. I would have much preferred they first fix withdrawals before any thing else.

It appears that the above issue has been fixed, so they've resumed their withdrawal services ^[source], but it seems that they're trying to rush everything ^{[I hope I'm wrong]}.
^{- BTW, they've allocated $8.1M in bounty rewards for those who can help with getting those funds back: BigONE Hack Bounty Program}

[The Cryptovator]

To be honest, I have heard about this BigOne exchange for the first time. I don't really use any low-reputable exchange, even for trading. As we always prefer, don't store your crypto in the centralised exchange; that's the reason. Because the exchange would be hacked and users would be affected. But if Big Exchange is hacked somehow, they give compensation to the users. But if the exchange is too small, then the hacked amount is quite bigger for them. I am not sure how they are going to handle the situation. But this is really very bad for the crypto users who probably lost funds.

That's the reason I don't store any big amount on the exchange. I just move the funds to the hardware wallet after buying coins from the exchange. So even if Exchange is hacked, my funds will be safe. But all exchange users don't care before something wrong happens, and they regret it after being hacked. We should learn from the other mistakes.

[coupable]

I have never used them, but I hoped they could give more information on how the hack occurred without any private key breach. I also understand that giving detailed information can serve as a blue print for other scammers and make them a target.

According to this article published today, BigOne exchanger said that the attack path had been identified and contained, and that no further losses are expected. There is no further details. Maybe because it's still under investigations by legal authorities.
The insident occured three days ago and this is what confirms that this exchange is not that popular because this explains how none here in bitcointalk notice and post about it until day 3, which confirms a big loss even the amount is not that big compared to other hacks from the last two years.

[joniboini]

Unfortunately, a $27 million hack is considered small nowadays. On the other hand, what's the operating income for small exchanges if something relatively unknown can lose $27 million and keep running their business (granted, they claimed there will be no further losses)? I remember a popular local exchange that I used in the past was also attacked (at least rumoured), and the number of losses is around $20-50 million iirc. They denied it, though, even though the circumstances were questionable.

[un_rank]

It appears that the above issue has been fixed, so they've resumed their withdrawal services ^[source], but it seems that they're trying to rush everything ^{[I hope I'm wrong]}.

This will give their users confidence to keep using them. But this should be a heads up to everyone to not store funds in an exchange, you do not control the security and cannot guarantee the safety of your funds.

^{- BTW, they've allocated $8.1M in bounty rewards for those who can help with getting those funds back: BigONE Hack Bounty Program}

I am surprised they have enough in reserves to organize this sort of bounty. They may obviously be banking on the fact that if they recover the funds they can pay from there, but I would normally have expected a small exchange to get rekt from such a hack.

- Jay -

[mindrust]

Was it Hacked or an inside job?

Back in the day many small time crypto exchanges went down like that because either the owner or the employees went rogue and stole the funds from the exchange they own/work for. This might be a similar story.

We’ll learn about it soon enough probably. The good thing is there is probably no forum user uses this exchange so the damage they caused on the community is little to nothing.

[tabas]

I have never used them. I guess we're used to the big hacks in the news and that's why the first reaction that we used to think of is that it's not as big as the major platforms.

From their X account, they are still yet to resume withdrawals but users can deposit and trade. I would have much preferred they first fix withdrawals before any thing else.

I agree, I remember when the news of Bybit hack has happened. I was quick to log into my account there and requested for a withdrawal and Ben did all processed the transactions and even took a loan to cover the losses even if it means suffering to them at that moment.

[JeromeTash]

Another case of an attack on a third party wallet provider?
Up to when will these exchanges learn a big lesson or is it just now a common excuse lately used to cover up their negligence?

I always thought exchanges try as much as possible to used noncustodial wallet services for their cold and hot wallets and not some third party. I think these attacks are mostly orchestrated by insiders.

[NotATether]

Was it Hacked or an inside job?

Back in the day many small time crypto exchanges went down like that because either the owner or the employees went rogue and stole the funds from the exchange they own/work for. This might be a similar story.

We’ll learn about it soon enough probably. The good thing is there is probably no forum user uses this exchange so the damage they caused on the community is little to nothing.

Leans more to being a hack to be honest, otherwise they wouldn't be giving out a big bounty to find the thief.

There is a saying I made up: "Old exchanges never die; young ones do."

I think it fits appropriately.