BitMart Hacked Again as Trail Points to Mercado Bitcoin

• BitMart founder Sheldon Xia confirmed the exchange was hacked a day before his public statement.
• On-chain investigators traced BitMart-linked funds to addresses tied to the Mercado Bitcoin exploit.
• The breach came during a week of attacks on Binance, a French bank and payment processors.
• No shared infrastructure provider or attack method has been confirmed.

BitMart, the exchange that suspended trading in August and is winding down under a restructuring plan, was hacked on November 2, founder Sheldon Xia confirmed the next day. Blockchain analytics firm Bitquery traced about $391,000 in suspicious outflows from wallets mostly tied to BitMart. The transfers started roughly 53 minutes before attackers began draining an estimated $48.6 million from Brazilian exchange Mercado Bitcoin, and part of the BitMart funds ended up at addresses linked to that second attack. Binance, a French bank and a self-hosted payment processor were also hit in the same week, so the bigger question is whether these attackers found a weak point shared by several platforms. How much BitMart itself lost matters less.

Xia Admitted the Hack but Gave No Loss Figure

Xia wrote on X that the exchange “got hacked yesterday too.” He called the damage relatively small and said early findings point to the same attackers behind Mercado Bitcoin. He gave no dollar figure, did not name the vulnerability and did not say whether customer balances were touched. The $391,000 estimate therefore rests on Bitquery’s on-chain investigation, which describes the wallets as linked to BitMart, a link the exchange has not confirmed.

The more revealing part of his statement concerned staffing. Xia described a security department left severely understaffed after the restructuring, and said threats against employees, leaks of their personal data and disputes with former staff pushed key engineers to leave. BitMart still holds customer assets while it prepares payouts to creditors, so the state of its security team matters more to them than the amount taken in this attack.

One Wallet Address Connects the Two Exchanges

Bitquery found the BitMart transfers on Base, Arbitrum and Optimism, all layer-2 networks that process transactions more cheaply and record them back on Ethereum. An on-chain observer posting as NeyLong separately traced BitMart-linked funds to an address that had already received money from the Mercado Bitcoin exploit. The shared address and the timing make a single attacker plausible. Proving it would take signing records or forensic access to both exchanges’ systems, and there is no sign that the three networks themselves were breached.

36,042 Wallets Emptied in Four and a Half Hours

Mercado Bitcoin said in its statement on X that it had identified and contained a security incident in one of its systems, and that customers suffered no losses and no data leaked. The exchange has since said it will absorb the losses with its own funds.

The exchange’s customer deposit addresses point to how the attack worked. Exchanges give each customer a separate address for incoming funds and regularly sweep those balances into a central wallet. The keys for all of those addresses usually come from a single master key or one internal signing service. Bitquery counted 36,042 Mercado Bitcoin Ethereum deposit addresses emptied between 12:27 and 16:56 UTC, which means the draining went on for about four hours after the exchange said at 12:56 UTC that the attack was contained. Those addresses held only about $266,000 in total. Being able to move funds out of that many of them suggests the attacker reached the root of the wallet system, which is why Bitquery said a shared supplier running wallets for both exchanges would be worth examining. It did not identify one.

A Week of Attacks on Withdrawal Systems

Binance’s breach on October 29 set the scale, with an estimated $6.3 billion impact and about $3 billion frozen, and Binance has since said it restored backing for 90% of the stolen assets. In its initial findings, Binance said a compromised DevOps engineer’s laptop may have let the attacker into a service container and submit unauthorized withdrawals, and that it found no evidence of a leaked wallet private key. On November 4, French banking group Crédit Mutuel Arkéa confirmed an attack that allowed fraudulent transactions. The bank said client assets were not affected and some transfers were only delayed, and it confirmed no amount. Investigator ZachXBT traced more than $133 million withdrawn through crypto exchange accounts between November 1 and 3 and swapped into ETH and Monero, and he said the laundering pattern does not match North Korea’s Lazarus Group.

Smaller targets were hit in the same window. BTCPay Server warned that attackers were draining hot wallets on instances running version 2.4.1 or older, and a dozen DeFi websites registered with Name.com were redirected to a wallet drainer. So far no evidence connects any of these incidents to each other. In nearly all of them, though, the attackers got into the systems that approve outgoing transfers, and none of them exploited a flaw in a blockchain.

BitMart’s Repayment Pool Is Now Exposed

BitMart hired restructuring firm Alvarez & Marsal to assess its liabilities. BitMart’s September 30 proposal offers users either an upfront payout or a restitution token whose value would depend on what the exchange recovers from its 2021 hack. Court applications could follow in December or January, with the wind-down due to finish by January 31, 2027. Any further losses would come out of the same pool that funds those payouts, which is already short the $319.5 million that BitMart’s own proposal says the 2021 hack drained from its reserves, far above the roughly $150 million the exchange reported at the time. BitMart has not said how the November 2 breach affects individual claims.

Investigators can still go after part of the Mercado Bitcoin money. Bitquery counted $11.8 million frozen by five stablecoin issuers, led by Tether with about $5.9 million and Circle with about $4.3 million. Another 106 BTC sits untouched at the attacker’s Bitcoin address, and 8,678 ETH worth about $20.1 million is spread across ten wallets after the attacker sold $11.9 million worth of 136 tokens through MetaMask’s swap service. If either exchange names a common wallet provider, that provider’s other clients would immediately face scrutiny.