- Trending
- Comments
- Latest
BitMart founder Sheldon Xia confirmed on November 3 that the exchange was hacked on November 2, and blockchain analysts say about $391,000 moved from BitMart-linked wallets to addresses tied to the attackers behind the Mercado Bitcoin exploit.
The breach hits an exchange that has already suspended trading and is negotiating a creditor restructuring. BitMart has not said how much it lost or how attackers got in.
Cryptocurrency exchange BitMart confirmed on November 3, 2026, that it had suffered another security breach a day earlier, after blockchain researchers identified suspicious transactions involving wallets associated with the platform and addresses connected to the Mercado Bitcoin exploit.
BitMart founder Sheldon Xia acknowledged the incident in a public statement on X, confirming that the exchange had been targeted on November 2.
He described the amount involved as relatively small and said the company had responded by investigating the breach and strengthening its security measures.
“Yes, we got hacked yesterday too,” Xia said, adding that the company had acted quickly after discovering the incident.
The disclosure has attracted attention because the suspected breach occurred around the same period as the security incident involving Mercado Bitcoin, one of Brazil’s prominent cryptocurrency exchanges.
According to BitMart’s preliminary investigation, the two incidents may have been connected to the same group of attackers. Although the exchange has not presented conclusive evidence establishing a direct relationship, blockchain activity has provided investigators with a potential starting point.
The BitMart hack also comes at a difficult time for the exchange, which has been dealing with restructuring challenges, customer withdrawal concerns and financial pressure following its decision to suspend trading services.
The latest development raises concerns beyond the immediate amount reportedly stolen. It also highlights the risks associated with exchanges experiencing operational difficulties while attempting to maintain the security of customer assets.
Blockchain intelligence has become central to understanding how the two security incidents may be connected. Investigators have been examining transactions involving wallets associated with BitMart and addresses identified during the Mercado Bitcoin investigation.
According to findings published by blockchain analytics company Bitquery, approximately $391,000 was transferred out of wallets largely associated with BitMart. The movements reportedly began about 53 minutes before the larger Mercado Bitcoin attack.
Bitquery’s investigation traced the transactions to addresses that were also connected to the attackers involved in the Brazilian exchange incident. The timing and destination of these transfers have strengthened suspicions that the two breaches could share a common source.
An independent blockchain observer identified as NeyLong also drew attention to transactions moving from BitMart-associated wallets to an address that had previously received funds from the Mercado Bitcoin incident.
The suspicious movements involved several cryptocurrencies, suggesting that investigators may need to examine activity across multiple blockchain networks to establish the full extent of the incident.
However, the available findings do not establish that both exchanges were compromised through the same vulnerability or that the attackers used identical methods.
A connection between wallet addresses is an important investigative lead, but it does not independently prove who controlled the wallets or how access was obtained.
BitMart has also not published a detailed breakdown of its losses or explained the precise method through which the attackers accessed the affected wallets.
This leaves several important questions unanswered, particularly regarding the amount involved, the security weakness exploited and whether any customer funds were affected.
Beyond the suspected connection with Mercado Bitcoin, the incident has exposed another challenge facing BitMart: maintaining adequate security personnel during a period of corporate restructuring.
In his November 3 statement, Xia explained that the exchange had retained only a limited core workforce following its restructuring process. He also pointed to threats against employees, doxxing and disagreements involving former personnel as factors that had complicated efforts to retain technical staff.
According to the founder, keeping essential employees involved in maintaining the platform’s infrastructure had required considerable effort.
“It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems,” Xia said.
He further acknowledged that the exchange’s security department was operating with fewer personnel than necessary.
The staffing situation is particularly significant because cryptocurrency exchanges manage complex systems that require continuous monitoring, wallet protection, transaction verification and incident response capabilities.
A reduced security workforce can create operational difficulties, especially when a platform is simultaneously dealing with financial restructuring, customer complaints and attempts to restore confidence.
Xia also accused a former head of marketing operations, identified as Elly, of participating in retaliatory actions against the company. These allegations were presented by the founder and have not been independently established in the report.
The latest security incident comes against the background of significant financial and operational difficulties at BitMart.
The exchange announced plans to wind down its trading operations in July 2026 before suspending trading services in August. It subsequently appointed financial advisory firm Alvarez & Marsal to assess its assets, liabilities and options for addressing outstanding customer withdrawals.
The company’s financial difficulties have also been linked to an earlier security breach in December 2021, when approximately $319.5 million in digital assets was reportedly lost.
According to BitMart’s restructuring proposal, the previous incident involved substantial losses across several cryptocurrencies, including approximately $164.1 million in Ethereum, $96.5 million in BNB and $51.5 million in Bitcoin.
Management also attributed some of its financial difficulties to declining trading revenue and losses associated with the exploitation of its futures trading incentive programmes.
The restructuring proposal gives affected customers options involving immediate distributions or potentially higher recoveries over a longer period. However, the final arrangements remain subject to further developments.
The exchange expects to revise its proposal in November before pursuing court applications in December 2026 or January 2027.
These circumstances make the BitMart hack particularly sensitive for customers who are already waiting for clarity regarding withdrawals and potential recovery arrangements.
Meanwhile, Mercado Bitcoin has disclosed additional information about its November 2 security incident, which affected wallets operating across several blockchain networks.
The Brazilian exchange initially suspended deposits and withdrawals after identifying suspicious activity within one of its systems.
Mercado Bitcoin estimated that approximately $38 million in assets were involved in the incident. It also reported that around $11 million had been frozen through cooperation with other industry participants.
Blockchain analytics company Chainalysis provided a separate assessment, estimating the stolen amount at approximately $49 million. The company also reported helping coordinate the freezing of nearly $10 million.
Chainalysis said its investigation involved cooperation with Mercado Bitcoin, law enforcement agencies and other industry participants to trace the stolen assets and identify opportunities to prevent their movement.
The exchange also published wallet addresses associated with suspicious transactions across Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron to support ongoing tracking efforts.
Copyright © 2025 - The Bit Gazette.
