BigONE Hack Bounty Program : Program Info

Focus Area

In July 2025, BigONE experienced a major security incident: attackers used sophisticated social engineering to compromise one key developer, obtaining relevant permissions and tampering with some part of source code in the production environment release process. After momentarily modifying the logic of some services of accounting and risk management, they transferred approximately $27 million (BTC, ETH, SOL, DOGE, TRX, etc.) from one hot wallet. Post-incident preliminary investigation confirmed that the private keys of all exchange crypto wallets remained secure and were not compromised. The platform has since implemented enhanced security measures and fully restored operations. All user assets have been fully covered by BigONE’s insurance reserve fund. This program seeks to identify those responsible for this single security incident, trace stolen assets, and facilitate stolen fund recovery. Verified contributions will be rewarded, with additional bounties for successful recoveries. White-hat participants who provide verified key information will be eligible for rewards. A percentage of the recovered amount will be distributed as a bounty to those who made significant contributions.

Incident Overview

In July 2025, BigONE suffered a major security incident. Third-party attackers used highly sophisticated social engineering techniques to compromise the development device of a key developer, thereby gaining unauthorized access and permissions. The attackers subsequently carried out a coordinated supply chain attack by deploying tampered code through version deployment service providers. This allowed them to temporarily alter the logic of specific accounting and risk management services within the platform, ultimately resulting in the unauthorized transfer of approximately USD 27 million worth of cryptocurrencies from one of BigONE’s hot wallets. The compromised assets included tokens from major public blockchains, including Bitcoin, Ethereum, Solana, Dogecoin, and Tron. Note: Preliminary investigation has confirmed the full attack path and logic. Following system reinforcement and post-accident updates, no further losses are expected. All BigONE wallet private keys and user data remain secure, with losses limited to a portion of assets from the targeted hot wallet. BigONE has fully covered all user losses using its insurance reserve fund, and all services have been resumed shortly. This bounty program aims to identify the attacker, trace the stolen assets, and assist with asset recovery. Verified and effective intelligence will be rewarded; if assets are successfully recovered, an additional 10% to 30% bounty will be awarded according to the level of contribution.

Key Fund Flows

2025-07-15 around 17 (UTC +0): Abnormal large withdrawal from the Exchange hot wallet; large amounts of BTC withdrawn. Other on-chain assets held in the targeted hot wallet—such as USDT, ETH, SOL, XIN and DOGE—were withdrawn and routed through multiple decentralized exchanges (DEXes) and cross-chain bridges. These assets were subsequently swapped across several hops into more liquid tokens, primarily including ETH, SOL and BNB.

Identified Information

Stolen Assets Destination Addresses

Ethereum & BSC: 0x9Bf7a4dDcA405929dba1FBB136F764F5892A8a7a

Solana: HSr1FNv266zCnVtUdZhfYrhgWx1a4LNEpMPDymQzPg4R

Bitcoin: bc1qwxm53zya6cuflxhcxy84t4c4wrmgrwqzd07jxm

Tron: TKKGH8bwmEEvyp3QkzDCbK61EwCHXdo17c

Subsequent Related Addresses

Ethereum: 0x0A360bD648EB86613961a2AA41dC1610c5305F4F

Solana: 7RWHQ7ujSFwokAPkAhHTdiPxRF2LmqrvgYEqDiAjLxdH

Tron: TCAfB8jHbJ56xwmfwKwWEs8HLRjbC2GfHG

Attackers IOC

IP addresses used for related attacks:

192.166.246.84
94.156.148.191
91.214.65.209
94.156.148.191
37.120.197.197
45.86.163.132
103.214.46.201
45.84.139.168
62.3.36.XX        
194.35.235.XX   
192.166.246.XX   
45.84.137.xxx
86.104.21.xxx

White Hat Investigation Scope

Attacker Identity Clues: Includes both on-chain and off-chain associations, such as wallet linkages, known social media accounts, and traces of centralized exchange (CEX) activity.
Transaction and Fund Flow Analysis: Detailed on-chain tracking, identification of coin mixing services, cross-chain laundering techniques, and any observable fund movement patterns.
Infrastructure Footprints: Any relevant IP addresses, domains, hosting providers, or server infrastructure used in the attack or post-exploit activities.
Other Forensic Leads: Any additional information or evidence that may assist in identifying or deanonymizing the attacker.

Rules & Guidelines

Accuracy

Submissions must be verifiable, objective, and must directly assist in identifying the attacker or tracing the stolen funds.

Details

Submissions should include:Blockchain transaction proofs (TX hashes, addresses, patterns). Cross-referenced intelligence (CEX account associations, email, IP, domain history). Technical analysis (heuristics, mixing methods, transaction clustering). Chain of custody proofs ensuring data integrity. Complete forensic intelligence chain. Supporting data to demonstrate intelligence value. Specific methods, tools, or techniques used. OriginalityInformation must be original and not previously disclosed.

Impact

Intelligence must provide actionable insight or significantly advance the investigation.

Feedback

Due to the complexity of the verification process, response times may be longer than for regular vulnerability reports.

Bounty Structure

High Impact: 5,000+ USD Direct evidence pointing to the attacker’s real-world identity, real address, etc.

Medium Impact: 1,000 – 5,000 USD IP, domain, device fingerprint, cross-chain asset clustering report, indirect identity association

Low Impact: 100 – 1,000 USD Supplementary on-chain path analysis, clarification of fund flow mixing patterns

Extra reward: In the event of a successful asset recovery, contributors may be eligible for an additional extra reward ranging from 10% to 30% of the recovered fund. The final extra reward percentage will be determined at the sole discretion of the platform, based on a comprehensive assessment of the contribution’s significance, technical difficulty, and overall impact on the recovery outcome.

Compliance Notice

All intelligence must comply with applicable laws and ethical standards· Unauthorised intrusion, system disruption, or any illegal activities are prohibited· Reports must not contain personal sensitive information (PII) obtained by illegal means

BigONE Hack Bounty Program : Program info