{"investigation":{"slug":"bilaxy","entity_name":"Bilaxy","trust_score":42,"severity_base":42,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Bilaxy is a centralized cryptocurrency exchange founded in 2018 and registered in the Seychelles. On August 28, 2021, the exchange suffered a hot wallet compromise in which an attacker transferred approximately 295–297 ERC-20 tokens valued at roughly $21–30 million to a single external address. The exchange suspended all services, later claimed to have reimbursed most affected users using platform funds, but drew sustained user complaints about exorbitant post-hack withdrawal fees and withheld balances.","sections":[{"content":"Bilaxy is a centralized cryptocurrency exchange launched in April 2018 and incorporated in the Republic of Seychelles, though some reports describe its operational base as Hong Kong. The platform markets itself as a global exchange serving traders in over 80 countries, with a focus on providing liquidity for newly listed tokens and altcoins. Bilaxy issues its own native utility token, Bilaxy Token (BIA), which is used to reduce trading fees from a standard 0.15% to 0.10% for both maker and taker orders. The exchange does not operate under a recognized Tier-1 regulatory framework, and public information about its founding team and corporate officers is limited.","heading":"Background and Operations","sources":[{"url":"https://tradingfinder.com/exchanges/bilaxy/","name":"Bilaxy Review January 2026 – TradingFinder","type":"research","credibility":2},{"url":"https://www.bitdegree.org/top-crypto-exchanges/bilaxy","name":"Bilaxy Trading Volume, Rankings, Markets – BitDegree","type":"research","credibility":2},{"url":"https://www.coingecko.com/en/exchanges/bilaxy","name":"Bilaxy Statistics: Markets, Trading Volume & Trust Score – CoinGecko","type":"other","credibility":2}],"severity":"medium"},{"content":"On August 28, 2021, between approximately 18:00 and 19:00 UTC, an attacker gained unauthorized access to Bilaxy's Ethereum hot wallet (address: 0xcce8d59affdd93be338fc77fa0a298c2cb65da59) and transferred approximately 295 to 297 ERC-20 tokens to a single address under the attacker's control (0xa14d5da3c6bf2d9304fe6d4bc6942395b4de048b). The stolen assets included major stablecoins and DeFi tokens such as Tether (USDT), USD Coin (USDC), and Uniswap (UNI), along with the exchange's own BIA token and hundreds of smaller altcoins. Estimates of the total value stolen range from approximately $21 million, as widely cited in crypto news outlets, to as high as $30 million according to on-chain analysis conducted by Merkle Science; the discrepancy reflects differing methodologies and token price snapshots. The root cause was identified as a private key compromise of the hot wallet, compounded by inadequate two-factor authentication controls and gaps in real-time blockchain transaction monitoring. According to the Distributed Networks Institute, as of August 2023 the attacker's address still held tokens valued at approximately $3.6 million, indicating only partial dissipation of the stolen funds.","heading":"August 2021 Hot Wallet Hack","sources":[{"url":"https://cointelegraph.com/news/bilaxy-exchange-suspends-website-after-erc-20-hot-wallet-hack","name":"Bilaxy Exchange Suspends Website After ERC-20 Hot Wallet Hack – CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.merklescience.com/blog/hack-track-analysis-of-the-bilaxy-hack","name":"Hack Track: Analysis of the Bilaxy Hack – Merkle Science","type":"research","credibility":2},{"url":"https://dn.institute/research/cyberattacks/incidents/2021-08-28-bilaxy/","name":"Bilaxy Exchange Security Breach – Distributed Networks Institute","type":"research","credibility":2},{"url":"https://www.pymnts.com/cryptocurrency/2021/crypto-exchange-bilaxy-loses-21m-in-hack/","name":"Crypto Exchange Bilaxy Loses $21M in Hack – PYMNTS","type":"news_article","credibility":2},{"url":"https://www.financemagnates.com/cryptocurrency/news/crypto-exchange-bilaxy-hacked-attacker-took-control-of-erc20-wallet/","name":"Crypto Exchange Bilaxy Hacked, Attacker Took Control of ERC20 Wallet – Finance Magnates","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the theft, the attacker routed a portion of the stolen Ethereum through Tornado Cash, a privacy-preserving coin-mixing protocol. According to Merkle Science's on-chain analysis, 200 ETH (valued at approximately $700,000 at the time) was sent to Tornado Cash in two separate transactions, a common obfuscation technique used to sever the on-chain link between stolen funds and their subsequent destination. At the time of Merkle Science's reporting, the hacker's wallet still retained 139.18 ETH (approximately $491,636) and over $10 million in additional stolen tokens that had not yet been moved or liquidated. The HOGE token community independently reported that nearly one billion HOGE tokens held on Bilaxy were among the assets transferred, causing HOGE's market price to fall approximately 35% in the immediate aftermath of the hack disclosure. No identified perpetrator or law enforcement recovery of the stolen funds has been publicly confirmed.","heading":"Fund Flows and Laundering Activity","sources":[{"url":"https://www.merklescience.com/blog/hack-track-analysis-of-the-bilaxy-hack","name":"Hack Track: Analysis of the Bilaxy Hack – Merkle Science","type":"research","credibility":2},{"url":"https://latesthackingnews.com/amp/2021/09/01/bilaxy-crypto-exchange-went-offline-after-cyber-attack/","name":"Bilaxy Crypto Exchange Went Offline After Cyber Attack – Latest Hacking News","type":"news_article","credibility":3},{"url":"https://www.pymnts.com/cryptocurrency/2021/crypto-exchange-bilaxy-loses-21m-in-hack/","name":"Crypto Exchange Bilaxy Loses $21M in Hack – PYMNTS","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Bilaxy first disclosed the incident to its users via Telegram on August 29, 2021, announcing that its hot wallet had been hacked and instructing all users to cease deposits immediately. The exchange's website was suspended for what was described as emergency system maintenance, with Bilaxy moving remaining hot wallet tokens into cold storage to prevent further losses. A more detailed incident timeline was posted via Telegram on August 30, 2021, in which the exchange acknowledged the private key compromise and stated that BTC, ETH, and other native assets held separately were unaffected, though subsequent on-chain analysis suggested ETH was also transferred. Bilaxy reported the incident to local authorities and stated that it was engaging professional security firms to audit its infrastructure and attempt fund recovery. The exchange projected a minimum two-week service outage while it rebuilt its system architecture; actual service resumption took considerably longer.","heading":"Exchange Response and Service Suspension","sources":[{"url":"https://cointelegraph.com/news/bilaxy-exchange-suspends-website-after-erc-20-hot-wallet-hack","name":"Bilaxy Exchange Suspends Website After ERC-20 Hot Wallet Hack – CoinTelegraph","type":"news_article","credibility":2},{"url":"https://dn.institute/research/cyberattacks/incidents/2021-08-28-bilaxy/","name":"Bilaxy Exchange Security Breach – Distributed Networks Institute","type":"research","credibility":2},{"url":"https://www.financemagnates.com/cryptocurrency/news/crypto-exchange-bilaxy-hacked-attacker-took-control-of-erc20-wallet/","name":"Crypto Exchange Bilaxy Hacked, Attacker Took Control of ERC20 Wallet – Finance Magnates","type":"news_article","credibility":2}],"severity":"high"},{"content":"Bilaxy subsequently claimed that it used its own platform funds to purchase and return the hacked tokens to affected users, stating this effort covered nearly 290 of the approximately 295 token types involved. For a small number of tokens that were effectively illiquid or whose issuing projects had been abandoned, the exchange stated it would open trading with provided liquidity or allow users to swap those balances into BIA tokens. Despite these assurances, user reviews on Trustpilot and other community forums alleged that Bilaxy imposed withdrawal fees equivalent to approximately 75% of user balances after the hack, effectively trapping funds on the platform. Multiple users reported that withdrawal fees for Ethereum-based assets reached $75 to over $100 per transaction, substantially higher than industry norms, and that the exchange cited insufficient hot wallet balances as justification for delayed withdrawals. These complaints are corroborated across multiple user review platforms and classified as low-to-medium confidence given the absence of independent verification, but the volume and consistency of reports indicates a pattern of alleged post-hack fund access restrictions.","heading":"Reimbursement Claims and User Complaints","sources":[{"url":"https://tradersunion.com/brokers/crypto/view/bilaxy/","name":"Bilaxy Review 2026: Pros, Cons and Key Features – TradersUnion","type":"research","credibility":2},{"url":"https://www.trustpilot.com/review/bilaxy.com","name":"Bilaxy Reviews – Trustpilot","type":"community_report","credibility":3},{"url":"https://www.forexpeacearmy.com/community/threads/bilaxyex-a-scam.72525/","name":"BilaxyEX: a SCAM – Forex Peace Army","type":"community_report","credibility":3},{"url":"https://blog.ueex.com/crypto-hacks/bilaxy/","name":"Bilaxy – Hack entry – UEEX Blog","type":"research","credibility":3}],"severity":"high"},{"content":"As of available data through early 2026, Bilaxy's website (bilaxy.com) remains accessible and the exchange continues to list trading pairs, though its reported 24-hour trading volume has declined substantially from pre-hack levels. CoinGecko and CoinMarketCap both continue to track the exchange, but neither platform affords it a high trust score. Bilaxy operates without a recognized Tier-1 regulatory license; it is not registered with the SEC, CFTC, FCA, or equivalent bodies, and operates from the Seychelles under a minimal-disclosure corporate structure. The identities of the exchange's founders and key personnel have not been publicly disclosed in any verified source. The combination of an unresolved major security breach, unverified reimbursement claims, alleged post-hack fee gouging, an opaque corporate structure, and no regulatory oversight places Bilaxy in a high-risk category for prospective users.","heading":"Current Operational Status and Risk Assessment","sources":[{"url":"https://www.coingecko.com/en/exchanges/bilaxy","name":"Bilaxy Statistics: Markets, Trading Volume & Trust Score – CoinGecko","type":"other","credibility":2},{"url":"https://coinmarketcap.com/exchanges/bilaxy/","name":"Bilaxy trade volume and market listings – CoinMarketCap","type":"other","credibility":2},{"url":"https://www.bitreporter.com/exchanges/bilaxy/","name":"Bilaxy Exchange Review – Withdrawal Speed, IEOs & Markets – BitReporter","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2018-04","event":"Bilaxy exchange founded and launched, incorporated in the Seychelles.","source":"TradingFinder Exchange Review","source_url":"https://tradingfinder.com/exchanges/bilaxy/","date_original":"2018-04-01"},{"date":"2021-08-28","event":"Hot wallet (0xcce8d59affdd93be338fc77fa0a298c2cb65da59) compromised between 18:00–19:00 UTC. Attacker transferred approximately 295–297 ERC-20 tokens to wallet 0xa14d5da3c6bf2d9304fe6d4bc6942395b4de048b. Estimated loss: $21–30 million.","source":"Merkle Science / CoinTelegraph","source_url":"https://www.merklescience.com/blog/hack-track-analysis-of-the-bilaxy-hack"},{"date":"2021-08-29","event":"Bilaxy posts Telegram announcement disclosing the hack and instructing users to halt all deposits. Exchange website suspended for emergency maintenance. Twitter announcement issued.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/bilaxy-exchange-suspends-website-after-erc-20-hot-wallet-hack"},{"date":"2021-08-29","event":"HOGE token community reports that nearly one billion HOGE tokens held on Bilaxy were stolen; HOGE market price drops approximately 35%.","source":"PYMNTS","source_url":"https://www.pymnts.com/cryptocurrency/2021/crypto-exchange-bilaxy-loses-21m-in-hack/"},{"date":"2021-08-30","event":"Bilaxy releases detailed incident timeline via Telegram. Remaining hot wallet assets moved to cold storage. Exchange states BTC and ETH native assets unaffected. Incident reported to local authorities.","source":"Distributed Networks Institute","source_url":"https://dn.institute/research/cyberattacks/incidents/2021-08-28-bilaxy/"},{"date":"2021-08-30","event":"Attacker routes 200 ETH (approximately $700,000) through Tornado Cash in two transactions to obscure fund origins.","source":"Merkle Science","source_url":"https://www.merklescience.com/blog/hack-track-analysis-of-the-bilaxy-hack"},{"date":"2021-09","event":"Exchange expected to remain offline for at least two weeks; security firms engaged to audit infrastructure.","source":"Latest Hacking News","source_url":"https://latesthackingnews.com/amp/2021/09/01/bilaxy-crypto-exchange-went-offline-after-cyber-attack/","date_original":"2021-09-01"},{"date":"2021-09","event":"Bilaxy announces plan to reimburse affected users using platform funds for approximately 290 of the affected token types.","source":"TradersUnion Review","source_url":"https://tradersunion.com/brokers/crypto/view/bilaxy/","date_original":"2021-09-01"},{"date":"2023-08","event":"On-chain data shows attacker's wallet still holds tokens valued at approximately $3.6 million, indicating stolen funds were never fully recovered or returned.","source":"Distributed Networks Institute","source_url":"https://dn.institute/research/cyberattacks/incidents/2021-08-28-bilaxy/","date_original":"2023-08-01"}],"sources_used":[{"url":"https://cointelegraph.com/news/bilaxy-exchange-suspends-website-after-erc-20-hot-wallet-hack","name":"Bilaxy Exchange Suspends Website After ERC-20 Hot Wallet Hack – CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260215233915/https://cointelegraph.com/news/bilaxy-exchange-suspends-website-after-erc-20-hot-wallet-hack","credibility":2,"archive_timestamp":"2026-02-15T23:39:15+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-analysis-of-the-bilaxy-hack","name":"Hack Track: Analysis of the Bilaxy Hack – Merkle Science","type":"research","archive_url":"http://web.archive.org/web/20260308034705/https://www.merklescience.com/blog/hack-track-analysis-of-the-bilaxy-hack","credibility":2,"archive_timestamp":"2026-03-08T03:47:05+00:00"},{"url":"https://dn.institute/research/cyberattacks/incidents/2021-08-28-bilaxy/","name":"Bilaxy Exchange Security Breach – Distributed Networks Institute","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.pymnts.com/cryptocurrency/2021/crypto-exchange-bilaxy-loses-21m-in-hack/","name":"Crypto Exchange Bilaxy Loses $21M in Hack – PYMNTS","type":"news_article","archive_url":"https://web.archive.org/web/20260725010914/https://www.pymnts.com/cryptocurrency/2021/crypto-exchange-bilaxy-loses-21m-in-hack/","credibility":2,"archive_timestamp":"2026-07-25T01:09:14+00:00"},{"url":"https://www.financemagnates.com/cryptocurrency/news/crypto-exchange-bilaxy-hacked-attacker-took-control-of-erc20-wallet/","name":"Crypto Exchange Bilaxy Hacked, Attacker Took Control of ERC20 Wallet – Finance Magnates","type":"news_article","archive_url":"https://web.archive.org/web/20260726035744/https://www.financemagnates.com/cryptocurrency/news/crypto-exchange-bilaxy-hacked-attacker-took-control-of-erc20-wallet/","credibility":2,"archive_timestamp":"2026-07-26T03:57:44+00:00"},{"url":"https://blog.ueex.com/crypto-hacks/bilaxy/","name":"Bilaxy – Hack entry – UEEX Blog","type":"research","archive_url":"https://web.archive.org/web/20260725043009/https://blog.ueex.com/crypto-hacks/bilaxy/","credibility":3,"archive_timestamp":"2026-07-25T04:30:09+00:00"},{"url":"https://latesthackingnews.com/amp/2021/09/01/bilaxy-crypto-exchange-went-offline-after-cyber-attack/","name":"Bilaxy Crypto Exchange Went Offline After Cyber Attack – Latest Hacking News","type":"news_article","archive_url":"https://web.archive.org/web/20260724225555/https://latesthackingnews.com/amp/2021/09/01/bilaxy-crypto-exchange-went-offline-after-cyber-attack/","credibility":3,"archive_timestamp":"2026-07-24T22:55:55+00:00"},{"url":"https://tradersunion.com/brokers/crypto/view/bilaxy/","name":"Bilaxy Review 2026: Pros, Cons and Key Features – TradersUnion","type":"research","archive_url":"https://web.archive.org/web/20260725130858/https://tradersunion.com/brokers/crypto/view/bilaxy/","credibility":2,"archive_timestamp":"2026-07-25T13:08:58+00:00"},{"url":"https://www.trustpilot.com/review/bilaxy.com","name":"Bilaxy Reviews – Trustpilot","type":"community_report","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.forexpeacearmy.com/community/threads/bilaxyex-a-scam.72525/","name":"BilaxyEX: a SCAM – Forex Peace Army","type":"community_report","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingecko.com/en/exchanges/bilaxy","name":"Bilaxy Statistics: Markets, Trading Volume & Trust Score – CoinGecko","type":"other","archive_url":"http://web.archive.org/web/20251112075853/https://www.coingecko.com/en/exchanges/bilaxy","credibility":2,"archive_timestamp":"2025-11-12T07:58:53+00:00"},{"url":"https://coinmarketcap.com/exchanges/bilaxy/","name":"Bilaxy trade volume and market listings – CoinMarketCap","type":"other","archive_url":"http://web.archive.org/web/20260718092136/https://coinmarketcap.com/exchanges/bilaxy/","credibility":2,"archive_timestamp":"2026-07-18T09:21:36+00:00"},{"url":"https://tradingfinder.com/exchanges/bilaxy/","name":"Bilaxy Review January 2026 – TradingFinder","type":"research","archive_url":"http://web.archive.org/web/20260421170042/https://tradingfinder.com/exchanges/bilaxy/","credibility":2,"archive_timestamp":"2026-04-21T17:00:42+00:00"},{"url":"https://www.bitreporter.com/exchanges/bilaxy/","name":"Bilaxy Exchange Review – BitReporter","type":"research","archive_url":"https://web.archive.org/web/20260724234016/https://www.hugedomains.com/domain_profile.cfm?d=bitreporter.com","credibility":2,"archive_timestamp":"2026-07-24T23:40:16+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-30T13:00:05.822919+00:00","updated_at":"2026-10-10T18:41:01.468+00:00"},"source_quality":{"total":15,"tier1":0,"tier2":1,"tier3":0,"unrated":14},"follower_count":null,"content_updated_at":"2026-10-10T18:41:01.723Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}