BitMart confirms fresh hack while running a bare-bones security team

BitMart got hit again. Founder Sheldon Xia confirmed on Nov. 3 that the exchange was hacked a day earlier, while it was already deep in a restructuring effort. He called the loss small and said his team moved fast to investigate and tighten security.

What he didn't say matters too. Xia never put a number on the damage, never named which systems were breached, and didn't address whether customer balances, deposits or withdrawals were touched. He also admitted the exchange's security team is 'currently severely understaffed' after restructuring left only a core crew keeping the lights on.

Blockchain sleuths filled in some gaps. Bitquery traced roughly $391,000 in outflows across Base, Arbitrum and Optimism, with nearly all of it coming from wallets it tied to BitMart. The firm flagged the Arbitrum and Optimism senders as BitMart hot wallets, and leaned on a wallet named in BitMart's proof of reserves to link the Base address. Bitquery noted BitMart hasn't confirmed it owns those wallets, so the figure isn't an exchange-verified loss.

The trail points toward a familiar crew. Xia said a preliminary investigation suggested the same attackers behind the hack of Brazil's Mercado Bitcoin. Bitquery found the BitMart-linked activity kicked off 53 minutes before the first Mercado Bitcoin funds moved, and an Arbiscan record shows a wallet labeled 'BitMart 21' sending ether to the same address that later received 2,852.07 ETH from the Ethereum hot wallet Bitquery attributes to Mercado Bitcoin. Both transfers happened on Nov. 2. The shared address is evidence, not proof of identity — nobody has established who got in or how.

Mercado Bitcoin went public with its own damage on Nov. 3: affected assets were worth $36.3 million at the time, and it managed to block $12.9 million. The Brazilian platform said customer assets are guaranteed, balances are still on the books, and it remains paused.

All of this lands on a BitMart that was already packing up. The exchange announced a wind-down in July, then pivoted to a restructuring plan that could include a phased restart of operations and payouts to creditors. Its indicative proposal offers users either upfront distributions or tokens tied to potential recoveries and other assets, with management aiming to file with the relevant courts around December 2026 or January 2027. Xia also said advisers have met with the top 50 users who still have funds stuck on the platform.