Cryptocurrency exchange BitMart has confirmed suffering another security breach on November 2, with its preliminary investigation suggesting that the attackers may be responsible for the recent hack of Brazil’s Mercado Bitcoin.
Summary
- BitMart founder Sheldon Xia confirmed that the exchange suffered another security breach on November 2 and said the amount involved was relatively small.
- Preliminary investigations suggest the attackers may be linked to the group behind the recent Mercado Bitcoin hack, with blockchain researchers identifying suspicious wallet transfers.
- Xia acknowledged that BitMart’s security team remains severely understaffed following restructuring, employee departures and disputes involving former personnel.
- The latest incident occurred as BitMart continued efforts to resolve customer withdrawals and financial difficulties following its decision to halt trading in August.
In a November 3 statement on X, BitMart founder Sheldon Xia acknowledged the incident after blockchain transactions surfaced showing funds moving from wallets associated with the exchange to an address linked to the Mercado Bitcoin exploit.
“Yes, we got hacked yesterday too,” Xia said, adding that the amount involved was small and that the company had quickly investigated the incident and strengthened its security measures.
The disclosure comes as BitMart continues restructuring its operations following its decision to halt trading in August, with unresolved customer withdrawals and financial difficulties already placing the exchange under pressure.
BitMart suspects the same hackers targeted Mercado Bitcoin
According to Xia, BitMart’s initial investigation suggests that the November 2 breach may have been carried out by the same group responsible for the attack on Mercado Bitcoin.
The Brazilian exchange suffered a major security incident earlier that day, with blockchain researchers identifying suspicious transfers across multiple networks.
Blockchain analytics firm Bitquery subsequently identified transactions involving wallets associated with BitMart that occurred before the main Mercado Bitcoin exploit.
In its on-chain investigation, Bitquery estimated that approximately $391,000 had been drained from wallets mostly linked to BitMart, beginning around 53 minutes before the larger attack.
The researchers traced the transactions to the same attacker-controlled addresses involved in the Mercado Bitcoin incident.
An X user, NeyLong, separately highlighted transfers from BitMart-associated wallets to an address that had received assets from the Brazilian exchange.
The transactions included several cryptocurrencies, with the wallet activity providing an early indication that the two incidents could involve a common attacker.
BitMart has not disclosed its own estimate of the losses or explained how the attackers gained access to its wallets.
BitMart founder says security team is severely understaffed
In his statement, Xia attributed some of the exchange’s current security difficulties to staff departures following its restructuring.
The company has retained only a core team, while threats against employees and disputes involving former personnel have made it difficult to maintain technical operations.
Xia specifically accused Elly, BitMart’s former head of marketing operations, of participating in retaliatory actions against the company.
He claimed that doxxing, threats from users and actions by disgruntled employees had discouraged technical personnel from remaining with the exchange.
“It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems,” Xia said.
According to the founder, BitMart continues to face numerous attacks despite its efforts to retain essential personnel.
“Our security team is currently severely understaffed,” he acknowledged, while maintaining that the remaining employees were working to protect customer data and assets.
The staffing difficulties follow months of operational problems that eventually led BitMart to suspend its trading services.
BitMart restructuring continues after earlier $319.5 million hack
BitMart halted trading in August after announcing plans to wind down its exchange operations in July.
The company subsequently appointed Alvarez & Marsal as its financial adviser to review its assets, liabilities and customer withdrawal arrangements.
It later opened a user engagement portal to collect feedback from affected customers as advisers assessed potential recovery options.
In its restructuring proposal, BitMart attributed its financial problems partly to losses from a December 2021 security breach.
The exchange said the earlier attack had depleted approximately $319.5 million in digital asset reserves, including $164.1 million in Ethereum, $96.5 million in BNB and $51.5 million in Bitcoin.
According to management, weaker trading revenues and losses associated with groups exploiting its futures trading incentives subsequently worsened its financial position.
The proposed restructuring would allow customers to choose between upfront distributions and potentially higher recoveries over a longer period, subject to the final arrangements.
BitMart expects to adjust its proposal during November before pursuing court applications in December 2026 or January 2027.
Mercado Bitcoin says $11 million in stolen assets has been frozen
Meanwhile, Mercado Bitcoin has provided further details about the November 2 attack, which affected wallets across several blockchain networks.
As previously reported by crypto.news, the exchange temporarily suspended deposits and withdrawals after identifying a security incident in one of its systems.
Mercado Bitcoin subsequently estimated that approximately $38 million in assets were involved and said around $11 million had been blocked with assistance from industry partners.
Blockchain analytics firm Chainalysis separately estimated the stolen amount at approximately $49 million and said it had helped coordinate the freezing of nearly $10 million.
In its November 2 report, Chainalysis described working with the exchange, law enforcement and other industry participants to trace the stolen assets and identify opportunities to block their movement.
Mercado Bitcoin has maintained that customers will not bear the financial losses from the incident.
The exchange published destination wallet addresses associated with the suspicious transactions across Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron to assist with tracking the stolen funds.
