Key Highlights
- BitMart founder Sheldon Xia confirmed a cyberattack on November 3, with on-chain analysis showing approximately $391,000 drained from BitMart-linked wallets across Base, Arbitrum, and Optimism.
- Preliminary investigation suggested the same group behind the Mercado Bitcoin breach may have carried out the BitMart attack, with on-chain data showing BitMart wallets targeted roughly 53 minutes before the larger incident.
- The breach comes as BitMart continues its wind-down and restructuring.
BitMart founder Sheldon Xia confirmed that the cryptocurrency exchange suffered a cyber attack on November 3, 2026. The incident occurred while the platform continues its wind-down of operations and works on a restructuring plan for remaining user funds.
Xia stated on X that the amount involved was relatively small. The team launched an investigation promptly and strengthened security measures. On-chain analysis indicated approximately $391,000 was drained from BitMart-linked wallets across three Ethereum layer-2 networks: Base, Arbitrum, and Optimism.
Details of the Breach and Suspected Links
Preliminary investigation by the BitMart team suggested the same group responsible for the attack on Brazilian exchange Mercado Bitcoin may have carried out the BitMart breach. On-chain data showed activity targeting BitMart wallets roughly 53 minutes before the larger Mercado Bitcoin incident.
Mercado Bitcoin reported a security incident on November 2 that affected assets valued in the range of about $36 million to $49 million across multiple blockchains, according to the exchange and on-chain estimates. Partners including Tether, Circle, Paxos, and Chainalysis helped freeze roughly $11 million to $13 million of those funds. Mercado Bitcoin said it would cover user losses and paused platform access as a precaution.
Xia noted that BitMart has retained only a core team during the restructuring. He cited challenges including user threats, doxxing, and issues with some former employees that made it difficult to keep technical staff. The security team remains understaffed but continues efforts to protect remaining data and assets. The platform faces ongoing attacks.
Restructuring Progress and User Meeting
BitMart began an orderly wind-down of its trading platform in late July 2026. New registrations and deposits were suspended, and all spot, futures, and other trading services ended by August 26, 2026. Full cessation of platform operations was originally planned for January 31, 2027, though restructuring efforts continue.
The exchange has appointed Alvarez & Marsal as financial adviser and White & Case as legal counsel to assess its position, stakeholder issues, and options. This includes a possible restructuring plan rather than a pure wind-down. The plan addresses a shortfall the company has linked in part to its December 2021 hack, which drained hot wallets and has been valued in restructuring documents at about $319.5 million based on then-prevailing prices, while original contemporaneous estimates were around $150 million to $200 million.
On Monday, Alvarez & Marsal and White & Case held a two-hour closed-door meeting with the top 50 users who still have funds on the platform. Xia reported that the meeting generated a great deal of positive feedback. A follow-up meeting is expected soon to discuss the restructuring proposal and move toward completing the process as quickly as possible.
The indicative proposal converts user account balances into dollarized figures and offers options that may include an upfront pro-rata distribution of available liquid assets such as fiat, stablecoins, and major tokens, a token linked to potential recoveries from the 2021 incident, or another token backed by other company assets or residual value. Consultations with major users form part of refining the plan ahead of any court filing targeted for later this year or early 2027.
BitMart Becomes A New Victim in Series of Cyber Attacks
The BitMart incident comes amid a series of significant security events at cryptocurrency platforms. In late October 2026, Binance reported a major breach involving roughly $6.3 billion in assets, attributed by U.S. authorities and analysts to a North Korea-linked group. The exchange said it would cover losses and has seen large customer outflows after reopening services. Around the same period, Indian exchange CoinDCX confirmed the drainage of about $16 million in USDT from certain wallets.
These events highlight ongoing challenges for centralized exchanges, particularly those managing residual assets or operating with reduced teams during transitions. BitMart’s confirmation adds to the scrutiny of security practices even as platforms wind down or restructure. Xia’s statements emphasise continued efforts to safeguard remaining assets while advancing discussions with creditors and users.
