BigONE Hack Bounty Program

Bug bounty BigONE Hack Bounty Program : Program info BigONE Hack Bounty Program Company: BigONE Global Exchange Scope Review: 227725 Submissions: 124 Total rewards: $200 Program left: 170 days ago Finished Submit report Contest is not active Program info Hackers 81 Reports 0 In July 2025, BigONE experienced a major security incident: attackers used sophisticated social engineering to compromise one key developer, obtaining relevant permissions and tampering with some part of source code in the production environment release process. All Scope Focus Area Incident Overview Key Fund Flows Identified Information Rules & Guidelines Compliance Notice Scope Search targets In scope Target │ Type │ Severity BigONE Hack Bounty Program Copy Other │ None Focus Area In July 2025, BigONE experienced a major security incident: attackers used sophisticated social engineering to compromise one key developer, obtaining relevant permissions and tampering with some part of source code in the production environment release process. After momentarily modifying the logic of some services of accounting and risk management, they transferred approximately $27 million (BTC, ETH, SOL, DOGE, TRX, etc.) from one hot wallet. Post-incident preliminary investigation confirmed that the private keys of all exchange crypto wallets remained secure and were not compromised. The platform has since implemented enhanced security measures and fully restored operations. All user assets have been fully covered by BigONE’s insurance reserve fund. This program seeks to identify those responsible for this single security incident, trace stolen assets, and facilitate stolen fund recovery. Verified contributions will be rewarded, with additional bounties for successful recoveries. White-hat participants who provide verified key information will be eligible for rewards. A percentage of the recovered amount will be distributed as a bounty to those who made significant contributions. Incident Overview In July 2025, BigONE suffered a major security incident. Third-party attackers used highly sophisticated social engineering techniques to compromise the development device of a key developer, thereby gaining unauthorized access and permissions. The attackers subsequently carried out a coordinated supply chain attack by deploying tampered code through version deployment service providers. This allowed them to temporarily alter the logic of specific accounting and risk management services within the platform, ultimately resulting in the unauthorized transfer of approximately USD 27 million worth of cryptocurrencies from one of BigONE’s hot wallets. The compromised assets included tokens from major public blockchains, including Bitcoin, Ethereum, Solana, Dogecoin, and Tron. Note: Preliminary investigation has confirmed the full attack path and logic. Following system reinforcement and post-accident updates, no further losses are expected. All BigONE wallet private keys and user data remain secure, with losses limited to a portion of assets from the targeted hot wallet. BigONE has fully covered all user losses using its insurance reserve fund, and all services have been resumed shortly. This bounty program aims to identify the attacker, trace the stolen assets, and assist with asset recovery. Verified and effective intelligence will be rewarded; if assets are successfully recovered, an additional 10% to 30% bounty will be awarded according to the level of contribution. Key Fund Flows 2025-07-15 around 17 (UTC +0): Abnormal large withdrawal from the Exchange hot wallet; large amounts of BTC withdrawn. Other on-chain assets held in the targeted hot wallet—such as USDT, ETH, SOL, XIN and DOGE—were withdrawn and routed through multiple decentralized exchanges (DEXes) and cross-chain bridges. These assets were subsequently swapped across several hops into more liquid tokens, primarily including ETH, SOL and BNB. Identified Information Stolen Assets Destination Addresses Ethereum & BSC : 0x9Bf7a4dDcA405929dba1FBB136F764F5892A8a7a Solana : HSr1FNv266zCnVtUdZhfYrhgWx1a4LNEpMPDymQzPg4R Bitcoin : bc1qwxm53zya6cuflxhcxy84t4c4wrmgrwqzd07jxm Tron : TKKGH8bwmEEvyp3QkzDCbK61EwCHXdo17c Subsequent Related Addresses Ethereum : 0x0A360bD648EB86613961a2AA41dC1610c5305F4F Solana : 7RWHQ7ujSFwokAPkAhHTdiPxRF2LmqrvgYEqDiAjLxdH Tron : TCAfB8jHbJ56xwmfwKwWEs8HLRjbC2GfHG Attackers IOC IP addresses used for related attacks: 192.166.246.84 94.156.148.191 91.214.65.209 94.156.148.191 37.120.197.197 45.86.163.132 103.214.46.201 45.84.139.168 62.3.36.62 194.35.235.127 192.166.246.84 86.104.21.176 45.84.137.xxx White Hat Investigation Scope Attacker Identity Clues : Includes both on-chain and off-chain associations, such as wallet linkages, known social media accounts, and traces of centralized exchange (CEX) activity. Transaction and Fund Flow Analysis : Detailed on-chain tracking, identification of coin mixing services, cross-chain laundering techniques, and any observable fund movement patterns. Infrastructure Footprints : Any relevant IP addresses, domains, hosting providers, or server infrastructure used in the attack or post-exploit activities. Other Forensic Leads : Any additional information or evidence that may assist in identifying or deanonymizing the attacker. Rules & Guidelines Accuracy Submissions must be verifiable, objective, and must directly assist in identifying the attacker or tracing the stolen funds. Details Submissions should include:Blockchain transaction proofs (TX hashes, addresses, patterns). Cross-referenced intelligence (CEX account associations, email, IP, domain history). Technical analysis (heuristics, mixing methods, transaction clustering). Chain of custody proofs ensuring data integrity. Complete forensic intelligence chain. Supporting data to demonstrate intelligence value. Specific methods, tools, or techniques used. OriginalityInformation must be original and not previously disclosed. Impact Intelligence must provide actionable insight or significantly advance the investigation. Feedback Due to the complexity of the verification process, response times may be longer than for regular vulnerability reports. Bounty Structure High Impact : 5,000+ USD Direct evidence pointing to the attacker’s real-world identity, real address, etc. Medium Impact : 1,000 – 5,000 USD IP, domain, device fingerprint, cross-chain asset clustering report, indirect identity association Low Impact : 100 – 1,000 USD Supplementary on-chain path analysis, clarification of fund flow mixing patterns Extra reward : In the event of a successful asset recovery, contributors may be eligible for an additional extra reward ranging from 10% to 30% of the recovered fund. The final extra reward percentage will be determined at the sole discretion of the platform, based on a comprehensive assessment of the contribution’s significance, technical difficulty, and overall impact on the recovery outcome. Compliance Notice All intelligence must comply with applicable laws and ethical standards· Unauthorised intrusion, system disruption, or any illegal activities are prohibited· Reports must not contain personal sensitive information (PII) obtained by illegal means Live since 18 Jul 2025 Published date 18 Jul 2025 Last updated 27 May 2026 Range of bounty $100 - $8,100,000 Severity Critical $2,000 - $10,000 High $1,000 - $2,000 Medium $500 - $1,000 Low $100 - $500 @poppy-boy KYC 1 @AnonymoushackerxDD-team KYC Verified 2 @jplopezy KYC Verified 3 @Anonx Verified 4 @EZeek33 KYC Verified 5 Response type Business days First Response 0d Triage Time 0d Reward Time 0d Resolution Time 0d