BitMart founder Sheldon Xia says the exchange's security team is "severely understaffed" after its restructuring. He made the admission while confirming that BitMart was hacked again on Monday, 2 November, and that it keeps facing numerous attacks.

For anyone with funds still on BitMart, two details matter. Fewer people are guarding the wallets than the founder says the exchange needs, and nobody at BitMart has put a number on Monday's loss. Xia called the amount small. He did not say how small.

Bitquery Traces About $391,000 From BitMart-Linked Wallets

Blockchain analytics firm Bitquery has filled part of that gap. Its investigation into the Mercado Bitcoin hack found that the attacker took about $391,000 on Base, Arbitrum and Optimism, mostly from wallets tied to BitMart. That activity started 53 minutes before the attacker drained Mercado Bitcoin, a Brazilian exchange.

Here is how Bitquery reconstructs that night:

  • Before the Mercado Bitcoin drain, the same address took $298,000 from wallets on the three chains, nearly all of it from three BitMart-linked wallets.
  • Bitquery's labels mark the Arbitrum wallet, 0xb4af…8f01, and the Optimism wallet as BitMart hot wallets, the internet-connected wallets an exchange uses for withdrawals.
  • The Base wallet is linked to BitMart through test payments with a BitMart proof-of-reserves wallet.
  • The attacker returned to Base at 20:20 UTC and moved 80 tokens out of that wallet in six minutes. About 1,400 Base deposit addresses were swept.

The $391,000 is Bitquery's estimate, not BitMart's. Bitquery describes the wallets as tied to BitMart, and the exchange has not confirmed the figure.

A Possible Link to the $48.6 Million Mercado Bitcoin Drain

Xia said he had a preliminary suspicion that the BitMart and Mercado Bitcoin incidents were connected. Bitquery's timeline is what gives that suspicion weight, but the firm stops short of calling it proven.

Its reasoning is conditional. If those wallets are BitMart's, Bitquery writes, "the hacker held keys at two exchanges on the same night. A shared supplier, such as a firm that runs wallets for both, would then be worth a look." Nobody has yet confirmed that one attacker hit both exchanges, or named such a supplier.

The Mercado Bitcoin side is far larger. Bitquery counts $48.6 million leaving the exchange's wallets on 10 blockchains on 2 November, more than the $40 million first reported. On Ethereum alone, the attacker emptied 36,042 customer deposit addresses and kept going for about four hours after the exchange said the attack was contained.

Some of the money is stuck. Stablecoin issuers have frozen $11.8 million, most of it by Tether, Circle and Paxos. The attacker sold $11.9 million of tokens for ETH on 3 and 4 November.

Xia Says Keeping Engineers Took 'Individual Conversations'

Xia's post on X described an exchange struggling to hold on to the people who run it. "It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems," he wrote.

He blamed threats against employees and alleged retaliation by former staff for making that harder. Those are his claims, and the brief behind this article offers no way to check them.

The timing is awkward. On the same Monday as the hack, BitMart put out a restructuring proposal that is reported to outline three recovery options for users, including liquid asset distributions and recovery-linked tokens. The exchange plans to seek court approval in December or January.

What BitMart Still Has Not Said

Xia has not given a loss figure for Monday's hack. He also has not explained how the attackers reached BitMart's wallets, which is the question any user weighing a restructuring offer would want answered first.

The next fixed point is the court application. Until then, the clearest public account of what left BitMart's wallets on 2 November comes from Bitquery's on-chain tracing, not from the exchange itself.