BitMart Confirms $391K Hack as Bitcoin ETFs Bleed $115.56M

BitMart got hit. The exchange confirmed a Nov. 2 security breach after blockchain sleuths spotted funds moving from wallets tied to the platform toward an address linked to the Mercado Bitcoin exploit. Founder Sheldon Xia owned it on X the next day — "Yes, we got hacked yesterday too" — saying the amount was small and that BitMart had already tightened its defenses.

Bitquery pegged the damage at roughly $391,000, drained from wallets mostly connected to BitMart and starting about 53 minutes before the larger Mercado Bitcoin attack unfolded. The timing has researchers eyeing a possible shared culprit, though no link has been confirmed.

Over in ETF land, the bleeding continued. US spot Bitcoin ETFs booked $115.56 million in net outflows in a single day, according to SoSoValue, with BlackRock's IBIT responsible for $94.98 million of the exits. Its total historical net inflow still sits at $65.81 billion. Bitwise's BITB pulled in $21.92 million and Fidelity's FBTC added $6.76 million, leaving the funds with $99.16 billion in net assets and a 6.33% ETF net asset ratio.

Solana co-founder Anatoly Yakovenko says the industry is guarding the wrong door. "Phishing and social engineering are the biggest threat to crypto. Not AI breaking math or quantum computers," he posted on X, urging users to keep a separate iOS device locked down with Apple's Lockdown Mode and to run a multisignature wallet. His warning lands after Binance's Oct. 29 breach, which by the outlet's account affected around $6.34 billion in digital assets.

Zcash is patching before it upgrades. The Zcash Foundation detailed seven security fixes shipped in Zebra 7.0.0, laying groundwork for the NU7 network upgrade on mainnet. Six of the flaws would have let a malicious peer node stall synchronization, hog verification resources, or get honest peers wrongly banned. Full-node operators need to be on the new version before block 3,543,405 to stay on the consensus chain — and the release migrates node storage from format v28 to v29 on first launch, no genesis resync required.

Hong Kong, meanwhile, is turning crypto into a paperwork trail. Lawmakers approved the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 on Nov. 4, adopting the OECD's CARF. Covered crypto businesses must start collecting customer and transaction data in 2027, and authorities can share it with overseas tax agencies from 2028.