BitMart hack tied to about $391K in transfers as security team shrinks

What happened

BitMart has confirmed a new security breach after blockchain analysts identified about $391,000 in suspicious transfers from wallets mostly linked to the exchange. Founder Sheldon Xia said in a Wednesday post on X that the hack occurred on Monday and that the company was dealing with a series of attacks. He called the amount small but did not give a figure. Bitquery later estimated the transfers at roughly $391,000 across three blockchains, according to Cointelegraph and Protos.

Bitquery traced the funds to a wallet that also appeared in the attack on Brazil's Mercado Bitcoin. Cointelegraph reported the Mercado Bitcoin breach at more than $46 million, while Protos said Mercado Bitcoin claimed $36 million and some reports cited a higher figure. Xia said BitMart's preliminary findings pointed to the same attacker or attackers in both incidents. The reports describe the tracing as supporting that suspicion rather than proving it.

Xia also said BitMart's security team is severely understaffed during restructuring. Cointelegraph reported that he cited threats against employees and alleged retaliation by former staff as reasons it had been hard to retain technical personnel. Protos said the founder referred to a dispute with former BitMart staff, including former head of marketing operations Elly. Xia said keeping key technical staff had taken considerable effort while attacks continued.

Why it matters

The reported loss is small next to several other incidents in the same reports, but the timing gives it weight. BitMart is already asking users to accept a restructuring, and earlier reports of delayed withdrawals and frozen accounts had raised questions about fund access. A new breach during that transition could complicate recovery planning and add to user uncertainty. The founder's staffing comments also draw attention to operational resilience, since security monitoring and incident response depend on retained technical staff. A confirmed link to the Mercado Bitcoin attacker would raise further questions about shared exposure, though the reports do not prove one.

What the data shows

Bitquery identified about $391,000 in suspicious transfers from wallets mostly associated with BitMart across three blockchains. The firm traced the funds to a wallet also implicated in the Mercado Bitcoin hack. Cointelegraph put the Mercado Bitcoin loss at more than $46 million, while Protos said Mercado Bitcoin claimed $36 million and some reports cited a higher total. Xia did not disclose a BitMart figure and described the loss as small. The reports also cite a $6.3 billion Binance breach last week and the reported dissolution of the T3 Financial Crime Unit, a Tron, Tether and TRM Labs initiative that had said it froze more than $450 million linked to suspected criminal activity since 2024.

Background

BitMart announced in July that it would end trading on Aug. 26 and cease operations in January 2027. Protos reported that the company later paused the shutdown in favor of a restructuring plan. Users subsequently reported delayed withdrawals and frozen accounts, according to Cointelegraph. In August, BitMart's Chinese-language X account alleged that employees had gone unpaid and demanded answers about customer funds; Xia dismissed the allegations as fabricated, and it remained unclear who controlled the account. On Monday, the exchange published a restructuring proposal with three possible recovery options, including liquid asset distributions and recovery-linked tokens. Cointelegraph reported that BitMart plans to seek court approval in December or January.

What is still unclear

Key details remain unresolved. The reports do not establish exactly how the BitMart breach happened, whether the same actor definitely carried out both attacks, or how much BitMart itself lost. Bitquery's $391,000 figure is an analytics estimate, while Xia's small-loss description lacks a number. It is also unclear who controlled BitMart's Chinese-language X account during the August allegations. BitMart did not respond to Cointelegraph's request for comment before publication.

What to watch

Attention now turns to BitMart's court approval process in December or January and to how users with locked funds respond to the proposed recovery options. Further disclosures could clarify the loss size and whether the Mercado Bitcoin link holds up. The exchange's ability to retain security and technical staff during restructuring will also be a factor to watch. The reports place the incident in a period of major crypto breaches and shifting industry coordination, including the T3 unit's reported disbandment.

Questions readers ask