$27 million gone, no private keys exposed: How the BigONE hack happened