BitMart Confirms Second Breach as Restructuring Continues
BitMart founder Sheldon Xia confirmed the exchange was hacked on November 2, a day before the company's disclosure. On-chain analysts linked the outflows to the same attacker wallets used in the Mercado Bitcoin exploit, though the reported loss figures differ between sources.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
BitMart founder Sheldon Xia confirmed in a November 3 post on X that the exchange was breached on November 2. Xia described the amount as small and said the team had investigated and tightened security, but he did not disclose a loss estimate or explain how the attackers gained access to BitMart-linked wallets.
Xia said the company's preliminary investigation points to the same group that attacked Brazil's Mercado Bitcoin earlier that day. Blockchain analytics firm Bitquery reported that roughly $391,000 was drained mostly from BitMart-associated wallets, starting about 53 minutes before the main Mercado Bitcoin exploit, and traced the funds to attacker-controlled addresses also used in that incident. Separately, an X user, NeyLong, highlighted transfers from BitMart wallets to an address that had received assets from Mercado Bitcoin.
Attribution and Open Questions
The two accounts agree on the link between the incidents but differ on framing. Bitquery's $391,000 figure is an on-chain estimate. BitMart has not confirmed that number or any other loss figure, so the amount drained from the exchange remains unverified by the company itself. The on-chain trail supports a common attacker, but the attribution to a specific group rests on the wallet overlap and on Xia's preliminary view.
Restructuring Under Strain
The breach comes as BitMart continues a restructuring that began with its July decision to wind down exchange operations and its August halt of trading. The company has appointed Alvarez & Marsal as financial adviser to review assets, liabilities and customer withdrawal arrangements, and has opened a user engagement portal for affected customers. Withdrawals remain unresolved for some users.
Xia attributed part of the security problem to staff departures. He said the company retained only a core team, and that doxxing, threats from users and disputes with former employees made it hard to keep technical staff. He named Elly, a former head of marketing operations, as having taken part in retaliatory actions, and acknowledged that the security team is "severely understaffed." These claims come from the founder and have not been independently verified.
Why It Matters
For Traders
Users with unresolved BitMart withdrawals should treat recovery timing as uncertain while the exchange is understaffed and its loss figures remain unconfirmed.
For Investors
Repeated security incidents during a wind-down signal elevated counterparty risk at BitMart and reinforce the importance of exchange solvency disclosures.
For Builders
Shared attacker wallets across two exchanges suggest monitoring cross-venue address overlap as an early warning signal for active intrusion campaigns.
This article is for information only and is not financial advice. Read the full disclaimer.
