Bilaxy Was Hacked for $21 Million in 2021. Users Say the Bill Never Stopped

Some exchange hacks become a single bad headline that fades. Others leave a trail that’s still visible years later in the exchange’s own review pages. Bilaxy, a Seychelles-registered platform that’s been operating since 2018, falls firmly into the second category — its 2021 breach is well documented, but what makes it worth a closer look in 2026 is how many user complaints about withdrawal fees and fund access are still surfacing on Trustpilot long after the incident was supposedly resolved.

What Happened in August 2021

On August 28, 2021, a hacker identified a vulnerability in Bilaxy’s front-end systems and exploited its hot wallet, making off with roughly $21 million across more than 300 different digital assets. The exchange suspended services, moved remaining funds to cold storage, and publicly committed to reimbursing affected users — a response that’s broadly in line with how a responsible exchange is supposed to handle a breach, at least on paper.

By Bilaxy’s own account, the exchange used its own funds over an extended period to buy back and restore the roughly 290 affected token types in stages, working to avoid those assets’ value collapsing to zero for the users holding them. That’s a genuinely more active recovery effort than many smaller exchanges manage after a comparable breach.

Where the Story Gets Complicated

The gap between that official recovery narrative and what users have reported since is significant. A consistent theme runs through Bilaxy’s Trustpilot reviews for years following the hack: users describing dramatically increased withdrawal fees in the breach’s aftermath, funds held up for extended periods, and a sense that the cost of making customers whole was effectively being passed back to the same customers through elevated transaction costs. Specific per-transaction withdrawal fees cited by reviewers — figures in the tens of dollars for stablecoin withdrawals — run well above what comparable exchanges typically charge for the same transaction type.

It’s worth treating individual angry reviews with appropriate skepticism; disgruntled users are naturally the ones motivated to leave public feedback, and a review platform skews toward complaints by its nature. But the volume and consistency of this specific complaint — elevated fees specifically tied to the hack, recurring across reviews spanning months — is different from scattered, unrelated grievances. A Trustpilot score sitting around 1.8 out of 5 reflects that pattern’s persistence rather than a handful of outlier posts.

What Independent Security Auditing Shows

CER.live’s security assessment of Bilaxy offers a genuinely useful, more objective complement to the user complaints: server security scores reasonably well at 89 out of 100, but user security sits at a much weaker 58, and penetration testing scores a flat 0 out of 100 — meaning, per that audit’s framework, there’s no evidence of a completed, verifiable penetration test on record. That’s a stark number to see for an exchange that’s already suffered one major front-end exploit, and it’s a meaningfully worse profile than the audits covered for larger platforms like XT.com or Coinstore elsewhere in this series, both of which at least show completed testing even where other gaps exist.

The Current State of the Platform

Bilaxy’s listed scale has shrunk considerably since its earlier years. Depending on the tracker and date, reported active coin counts range from a sparse 14 cryptocurrencies to claims of nearly 1,000 trading pairs — a gap wide enough to suggest significant platform activity has simply declined rather than being a matter of definitional confusion. Daily trading volume figures in the single-digit millions, modest for an exchange that’s been operating for more than seven years, round out a picture of a platform that’s survived its 2021 breach but hasn’t meaningfully recovered the trust or activity it had before.

Fees sit at a flat 0.25% for makers and takers, with a 50% discount available for users paying in Bilaxy’s own BIA token — unremarkable pricing on its own, though it’s worth weighing against the withdrawal-fee complaints above, since a competitive headline trading fee doesn’t offset a steep cost at the point of actually getting funds out.

What This Actually Adds Up To

None of this means Bilaxy is actively defrauding its users today — the 2021 reimbursement effort, however imperfectly executed in practice, was a real commitment of the company’s own resources rather than an abandonment of affected customers. But the combination of a serious historical breach, a zero score on independent penetration testing years later, persistent and specific complaints about post-hack fee increases, and a trading volume that suggests the platform never fully rebuilt its user base points toward an exchange that’s survived rather than recovered. For anyone considering it specifically for altcoin access unavailable elsewhere, the sensible approach is the same one worth applying to any platform with this risk profile: keep balances small, test a withdrawal early and often rather than letting funds accumulate, and treat the fee schedule’s fine print as more informative than its headline rate. Wes Ibarra’s exchange coverage keeps returning to this same pattern — a platform’s hardest year rarely stays fully in the past, and the review record usually knows it before the marketing copy admits it.