BitMart has confirmed that it suffered another security breach on Nov. 2, and the exchange's founder said initial findings point to the same actors believed to be behind the attack on Brazil's Mercado Bitcoin the same day.
In a Nov. 3 post on X, BitMart founder Sheldon Xia acknowledged the incident after on-chain transactions showed funds moving out of exchange-linked wallets to an address tied to the Mercado Bitcoin exploit. "Yes, we got hacked yesterday too," he wrote, adding that the amount involved was small and that the company had moved quickly to investigate and tighten security.
The disclosure lands while BitMart is still working through a restructuring that began after it halted trading in August, with customer withdrawals unresolved and the company under financial strain.
Overlapping wallets point to a common attacker
Blockchain analytics firm Bitquery traced roughly $391,000 drained from wallets mostly connected to BitMart, with the transfers starting about 53 minutes before the larger Mercado Bitcoin exploit. The researchers followed the funds to the same attacker-controlled addresses used in the Brazilian exchange's incident.
Mercado Bitcoin confirmed its own breach on Nov. 2 and temporarily suspended deposits and withdrawals while it investigated unauthorized activity. The exchange has estimated that about $38 million in assets were involved and said roughly $11 million had been blocked with help from industry partners. Chainalysis put the stolen amount at approximately $49 million and said it helped coordinate the freezing of nearly $10 million.
Separate analysis by Hypernative identified about 106 BTC, 2,852 ETH, 10,700 SOL and 6.7 million XLM in assets linked to the attacker, with most of the initial transfers occurring between 06:19 and 06:53 UTC, a pattern that suggests coordination across networks. Bitquery later reported that Ethereum alone accounted for roughly $29.5 million of the suspicious transfers.
Note: Figures are from Hypernative and Bitquery analyses of the Nov. 2 incident and cover assets across multiple networks.
BitMart has not published its own loss estimate or explained how the attackers obtained access to its wallets. Mercado Bitcoin, which published destination addresses across Stellar, Bitcoin, Solana, Tron and Ethereum-compatible networks to aid tracking, has said customers will not bear the financial losses and that no personal information was exposed. It has not confirmed a total stolen figure or described how the attacker gained transaction-signing access.
Understaffed security team
Xia attributed part of the exchange's security difficulty to staff departures during the restructuring. BitMart has kept only a core team, and he said threats against employees and disputes with former personnel have made technical operations harder to sustain. He accused Elly, BitMart's former head of marketing operations, of taking part in retaliatory actions against the company, and said doxxing and pressure from users had discouraged technical staff from staying.
"It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems," Xia said. Even so, he conceded: "Our security team is currently severely understaffed." The remaining employees, he said, are working to protect customer data and assets, and the exchange continues to face repeated attacks.
The staffing problems cap months of operational trouble. BitMart announced in July that it would wind down its exchange operations and stopped trading in August. It then appointed Alvarez & Marsal as financial adviser to review assets, liabilities and customer withdrawal arrangements, and later opened a portal for affected users to submit feedback as advisers weighed recovery options.
In its restructuring proposal, BitMart traced part of its financial distress to a December 2021 breach that it said drained about $319.5 million of digital asset reserves, including $164.1 million in Ethereum, $96.5 million in BNB and $51.5 million in Bitcoin. Management also cited weaker trading revenue and losses tied to groups exploiting its futures trading incentives. The plan would let customers choose between upfront distributions and potentially higher recoveries over a longer period, subject to final terms. BitMart expects to revise the proposal during November before seeking court applications in December 2026 or January 2027.
Recovery limits and market read-through
The overlap between the two incidents complicates recovery. Chainalysis said it worked with Ripple, Tether, Circle and other firms to identify stolen funds, helping freeze more than $9 million in USDT. But native XLM cannot be frozen through the issuer-controlled mechanisms that centralized stablecoins rely on, leaving exchange cooperation and transaction monitoring as the main tools for tracing stolen Stellar tokens.
Investigators have found no evidence that the Stellar blockchain itself was compromised, and the breach does not appear connected to Mercado Bitcoin's earlier tokenization work on the XRP Ledger or to a $20 million investment it received from Tether.
For traders, the episode reinforces how quickly a single compromised wallet can spread losses across a dozen networks, and how much recovery depends on stablecoin issuers' ability to freeze assets. For exchanges still operating, it sharpens scrutiny of reserves, key management and staffing at a time when consolidation and wind-downs are thinning out back-office security teams.
