Sheldon Xia said the amount was small and his security team severely understaffed. Bitquery traced about $391,000 out of wallets mostly linked to the exchange into addresses used in the Mercado Bitcoin attack, beginning about 53 minutes before it.
BitMart, the exchange that announced its own wind-down in July, was breached again on November 2. Founder Sheldon Xia confirmed it in a post on X the following day, reported by crypto.news and separately by ChainCatcher: "Yes, we got hacked yesterday too," he wrote, and "The amount involved was small, and we acted quickly to investigate and strengthen security." Neither account reports a loss figure, the systems involved, or whether customer funds or personal data were exposed.
What he did say about the exchange's defenses matters more to the roughly 13 million accounts BitMart has claimed. "Our security team is currently severely understaffed," Xia said, attributing the shortage to the restructuring and to the staff departures that followed it.
Xia also said preliminary findings suggest the group that attacked Mercado Bitcoin may have been responsible. Bitquery, a blockchain analytics firm, supplied the only published on-chain basis for that: about $391,000 left wallets mostly linked to BitMart and moved to the same attacker-controlled addresses used in the Mercado incident, with the outflows beginning about 53 minutes before the larger attack on the Brazilian exchange. An account on X, NeyLong, flagged the same transfers.
That is an overlap in timing and destination, not an identification. A shared receiving address establishes where funds went rather than who sent them, and BitMart has not confirmed that it controlled every wallet in the trace. The $391,000 is traced outflow and not a disclosed loss. BitMart has published no loss figure of its own, and Xia's "small" is the only characterization on the record.
Mercado Bitcoin, which paused withdrawals on November 2, has its own unsettled numbers. The exchange put about $38 million of assets as involved and about $11 million as blocked with help from industry partners. Chainalysis estimated about $49 million stolen and nearly $10 million frozen. Bitquery put the theft at about $48.6 million across ten blockchains. The three figures measure different things, assets involved against assets stolen, and none of them has been reconciled in public.
BitMart's own position is harder than Mercado's. The exchange wound down without telling its global chief executive first, terminating Nenter Chow in late July and telling its community two days later that it was closing. Deposits stopped on July 26, trading ceased on August 26, and the platform is scheduled to wind down completely on January 31, 2027. Customer withdrawals are still unresolved.
The company appointed Alvarez & Marsal to review its assets, liabilities and customer withdrawal arrangements, and its restructuring proposal offers customers a choice between an upfront distribution and a potentially larger recovery over a longer period. BitMart expects to adjust that proposal during November and then take it to court, with applications expected in December or January.
The proposal also restates the size of the hole the exchange has been carrying. It attributes about $319.5 million of depleted reserves to the December 2021 breach, and gives the split as $164.1 million in Ethereum, $96.5 million in BNB and $51.5 million in Bitcoin. Those three legs sum to $312.1 million, so about $7.4 million of the stated total is not accounted for in the published breakdown. The figure on the public record from the time is lower still. CoinDesk, citing PeckShield, put that hack at about $196 million, roughly $100 million on Ethereum and $96 million on Binance Smart Chain.
The two totals are not a correction of one by the other. The BNB legs agree within half a million dollars. BitMart's own accounting adds $51.5 million of bitcoin, which PeckShield's estimate did not cover at all, and puts the Ethereum loss at $164.1 million against PeckShield's $100 million. What separates them is asset coverage and scope rather than one superseding the other, the company has published no reconciliation of either its own breakdown or the gap with PeckShield, and neither total should be read as a settled loss.
BitMart said in 2021 that it would compensate users from its own funds, and the Federal Trade Commission later opened an investigation into whether its disclosures had been adequate. That investigation was publicly unresolved when MiningPool reported the wind-down in August, and nothing checked for this report updates it.
For customers the operative dates have not moved: a proposal to be revised this month, court applications expected in December or January, and a platform scheduled to close on January 31. What the November 2 intrusion adds to that sequence is a disclosure with no number attached to it.
