A BitMart security breach on November 2, 2026, involved a relatively small amount of funds, founder Sheldon Xia said, as preliminary findings pointed to a possible link with the Mercado Bitcoin hack. The incident hit an exchange already dealing with suspended trading, unresolved customer withdrawals and a severely understaffed security team.
Key takeaways
Bitquery traced approximately $391,000 drained from wallets mostly linked to BitMart.
Xia described staffing shortages following restructuring and employee disputes.
Mercado Bitcoin reported about $38 million involved and around $11 million blocked.
BitMart’s restructuring proposal cites approximately $319.5 million lost in December 2021.
BitMart security breach investigation points to shared addresses
BitMart’s initial investigation suggests the group behind the Mercado Bitcoin attack also targeted its wallets, Xia said in a November 3 statement on X. Blockchain analysis identified transfers to addresses associated with the Brazilian exchange’s exploit.
Bitquery estimated that approximately $391,000 left wallets mostly associated with BitMart, starting around 53 minutes before the larger Mercado Bitcoin attack. Its researchers traced those transfers to the same attacker-controlled addresses involved in that incident.
In a separate post, X user NeyLong pointed out transfers moving from BitMart-linked wallets toward an address that had previously taken in funds from Mercado Bitcoin. The suspected connection remains preliminary.
Xia said BitMart quickly investigated and strengthened its security. The exchange has not disclosed its own loss estimate or explained how attackers accessed its wallets.
Staff shortages complicate technical operations
BitMart has retained only a core team following restructuring, and Xia described its security staff as “severely understaffed.” He attributed difficulties retaining technical personnel to departures, doxxing, user threats and disputes with former employees.
Xia accused Elly, the exchange’s former head of marketing operations, of retaliatory actions against BitMart. He said individual conversations were needed to persuade key technical staff to stay and maintain core systems.
According to Xia, the exchange continues to face numerous attacks. He said remaining employees were working to safeguard customer data and assets.
Restructuring follows trading halt and earlier losses
The BitMart security breach occurred during a restructuring that followed plans to wind down exchange operations in July and a trading halt in August 2026. Alvarez & Marsal became its financial adviser to review assets, liabilities and customer withdrawal arrangements.
BitMart also opened a user engagement portal to gather customer feedback while advisers assessed recovery options. Under its plan, creditors can choose between immediate payouts or waiting longer for potentially larger recoveries, pending final terms.
According to the restructuring plan, part of the company’s financial trouble stems from a hack in December 2021 that wiped out roughly $319.5 million worth of digital asset holdings, including $164.1 million in Ethereum , $96.5 million in BNB, and $51.5 million in Bitcoin.
According to management, declining trading income combined with losses tied to groups gaming futures trading incentive programs further strained the company’s financial position. BitMart intends to update the proposal sometime in November, ahead of filing court applications between December 2026 and January 2027.
Mercado Bitcoin reports asset freezes and customer protection
According to Mercado Bitcoin’s own estimate, the November 2 breach affected roughly $38 million in assets, of which about $11 million was frozen with help from industry partners. Upon discovering the breach, the exchange temporarily halted both deposits and withdrawals.
Chainalysis separately estimated stolen assets at approximately $49 million and said it helped coordinate freezes of nearly $10 million. Its November 2 report described collaboration with the exchange, law enforcement and industry participants to trace funds and block their movement.
Tether CEO Paolo Ardoino confirmed that the issuer froze more than 4.5 million USDT linked to the incident. Arkham analyst Emmett Gallic said the attacker swept funds from older deposit addresses and sold memecoins and other altcoins.
Mercado Bitcoin said customers would not bear the losses and that the incident caused no data breach. It published destination addresses across Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron to support tracking.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
