BitMart founder Sheldon Xia has confirmed a November 2 hack while the exchange continues restructuring. The incident adds a security problem to an already difficult period for customers seeking information about their assets and the platform’s proposed recovery arrangements.
Xia described the amount involved as small without giving a figure. Blockchain researchers have published their own estimate and identified wallet activity potentially connecting the incident to the Mercado Bitcoin attack.
Key Takeaways
- BitMart’s founder confirmed a new hack but did not disclose a loss total.
- Bitquery estimates about $424,000 from wallets it associates with BitMart.
- Customers should follow restructuring notices and heed the exchange’s warning against further deposits.
What the Founder Confirmed
In a November 3 post reported by crypto.news, Xia said BitMart had been hacked the previous day and had acted to investigate and strengthen security. He said a preliminary investigation pointed to the group behind the Mercado Bitcoin incident.
Xia also described the security team as severely understaffed following restructuring and difficulties retaining technical personnel. That is the founder’s account of the staffing situation, rather than an independently audited assessment of the exchange’s controls.
The public disclosure does not establish how the attacker obtained access. It also leaves open which specific wallets were affected and how the new incident relates to customer claims under the restructuring.
What Blockchain Researchers Found
In its updated investigation, Bitquery counts approximately $424,000 taken from wallets it links to BitMart. The report describes activity on Base, Arbitrum and Optimism, with additional amounts on five smaller networks.
Its attribution uses address labels and transaction history. Bitquery says the receiving address also handled funds from the Mercado Bitcoin attack, and that the earlier transfers began around 53 minutes before Mercado Bitcoin’s main outflows.
That overlap supports investigating a possible connection. It does not establish a shared technical vulnerability, supplier or initial access method. The estimate should remain attributed to Bitquery rather than presented as BitMart’s confirmed financial loss.
Our Mercado Bitcoin reopening report covers the separate recovery process at the Brazilian exchange. Similar wallet activity does not mean the two companies have the same service-restoration timetable.
Restructuring Predates the New Hack
BitMart’s November customer notice says it announced a wind-down in July and stopped trading in August. Formal cessation of platform operations is scheduled for January 31, 2027.
The notice describes proposed recovery options intended for a court-sanctioned process. Its indicative timetable calls for adjustments following user feedback during November, with court applications targeted for December 2026 or January 2027.
Those are proposed milestones, rather than proof that a court has approved distributions or that customers can withdraw immediately. The latest hack and the broader restructuring should therefore be tracked as related but distinct developments.
What Customers Should Check
The exchange explicitly warns users not to deposit further assets. It says deposit services are suspended, transfers may not be automatically credited and addresses may still appear on some pages. A visible address is not confirmation that deposits are supported.
Keep records of balances, transaction references and communications about any recovery option. Check the date and status of each notice before treating a proposed timetable as final. If you receive instructions about a claim, compare them with the official notice before submitting information. A message mentioning your exchange account or an authentic-looking logo does not establish that its sender is authorised. UEEx’s crypto hacks archive provides wider context on incident disclosures and loss estimates.
BitMart also warns that there is no paid service for expedited withdrawals and that it will not request passwords, authentication codes, private keys or recovery phrases. Our guide to protecting crypto from hackers covers precautions against impersonation and credential theft.
Conclusion
The new breach raises further questions about security during BitMart’s restructuring. Customers should distinguish confirmed company statements, researcher estimates and proposed recovery terms, while avoiding new deposits and unofficial withdrawal offers. Clear updates on the investigation and restructuring process remain the next important developments.
