BitMart Founder Confirms Hack During Restructuring

BitMart founder Sheldon Xia said the crypto exchange was hacked on Nov. 2 while undergoing restructuring, adding that its security team is “severely understaffed.”

“Yes, we got hacked yesterday too. The amount involved was small, and we acted quickly to investigate and strengthen security,” Xia wrote in a Nov. 3 post on X.

His statement did not quantify the loss, identify the affected systems or say whether customer balances, deposits or withdrawals were affected. Users still have funds on the platform: in a separate restructuring update, Xia said advisers had met with the top 50 users who still held funds there.

Xia said a preliminary investigation suggested the same group may have carried out the attack on Brazil’s Mercado Bitcoin. Independent blockchain analysis provides evidence of a shared receiving address, though it does not establish the attackers’ identities or how they gained access.

A Shared Destination

Blockchain data firm Bitquery reported about $391,000 taken on Base, Arbitrum and Optimism, nearly all from wallets it linked to BitMart. The activity began 53 minutes before the first Mercado Bitcoin funds moved, according to its investigation.

Bitquery labeled the Arbitrum and Optimism source wallets as BitMart hot wallets. Its attribution of the Base wallet relied on earlier transfers with a wallet listed in BitMart’s proof of reserves. The firm said BitMart had not confirmed ownership of those specific wallets; its estimate is not a loss figure confirmed by the exchange.

An Arbiscan transaction record shows a wallet labeled “BitMart 21” sending ether to the same address that subsequently received 2,852.07 ETH from the Ethereum hot wallet Bitquery identified as Mercado Bitcoin’s. Both transactions occurred on Nov. 2.

Mercado Bitcoin said on Nov. 3 that affected assets were then worth $36.3 million and that it had blocked $12.9 million. It said customer assets were guaranteed and account balances remained recorded, while its platform remained paused.

Funds Remain in Restructuring

The breach comes after BitMart’s July wind-down announcement. The exchange subsequently began developing a restructuring alternative, including a possible phased resumption of operations and distributions to creditors.

Xia said restructuring had left only a core team maintaining the systems. “Our security team is currently severely understaffed, but we are still doing everything we can to safeguard data and assets,” he wrote.

BitMart’s initial indicative restructuring proposal offers users a choice of upfront distributions or tokens tied to potential recoveries and other assets. Its timetable targets December 2026 or January 2027 for management to apply to the relevant courts over the plan.