BitMart confirms new hack amid $391,000 suspicious transfers

By Tom Whitfield

Approximately $391,000 in suspicious transfers came from wallets mostly associated with crypto exchange BitMart across three blockchains, according to Bitquery’s Wednesday investigation. BitMart founder Sheldon Xia separately confirmed a new hack on Wednesday, called the amount small and said the incident may be linked to the more than $46 million breach at Brazil’s Mercado Bitcoin on Monday, Nov. 2.

What links the BitMart and Mercado Bitcoin incidents?

Bitquery traced the suspicious funds to a wallet also implicated in the Mercado Bitcoin attack. That on-chain overlap provides the basis for Xia’s preliminary suspicion about a possible connection.

The incidents differ in scale: roughly $391,000 in suspicious BitMart transfers compared with more than $46 million at Mercado Bitcoin. The shared wallet supports a possible connection, but it does not identify its controller or establish a common operator.

Why is BitMart’s security team under strain?

Xia said threats against employees and alleged retaliation by former staff complicated BitMart’s effort to retain technical personnel. He wrote on X: “It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems.”

He added: “However, we continue to face numerous attacks. Our security team is currently severely understaffed, but we are still doing everything we can to safeguard data and assets.”

Xia described Monday’s hack as small but did not disclose a figure. Bitquery’s $391,000 estimate therefore measures suspicious transfers identified across three blockchains, not a company-confirmed loss or a final finding on responsibility.

For customers, the operational issue is whether a severely understaffed team can maintain systems and safeguard assets during the wind-down. Xia gave no staffing count or remediation timetable, while users have reported delayed withdrawals and frozen accounts.

What changes for BitMart users?

BitMart announced in July that it would end trading on Aug. 26 and cease operations in January 2027. After the announcement, users reported delayed withdrawals and frozen accounts, raising concerns about access to their funds.

The sequence has left months of uncertainty around the exchange’s ability to return assets. In August, BitMart’s Chinese-language X account alleged that employees had gone unpaid and demanded answers about customer funds. Xia dismissed the allegations as fabricated, though it remained unclear who controlled the account at the time.

On Monday, BitMart published a restructuring proposal with three potential recovery options for users. The proposal included liquid asset distributions and recovery-linked tokens, and the exchange planned to seek court approval in December or January.

That timetable makes December or January the first formal test of the recovery plan, ahead of the scheduled January 2027 cessation. The proposal names two mechanisms but ties their implementation to a request for court approval.

Cointelegraph said it had contacted BitMart for details about the restructuring, security staffing and latest breach. The outlet had not received a response by publication.

Why does the T3 alliance’s dissolution matter?

Bloomberg reported Wednesday that the T3 Financial Crime Unit has dissolved. Tron, Tether and TRM Labs launched the alliance in September 2024, and Binance later joined it. Citing people familiar with the matter, Bloomberg said the group struggled with slow responses and poor coordination; one source said it disbanded in late August.

In May, T3 said it had helped freeze more than $450 million in assets linked to suspected criminal activity since its 2024 launch. Its reported coordination problems explain the operational cost: shared crime-fighting depended on several members acting together, while response times lagged.

The dissolution comes amid a wave of major crypto hacks, including a $6.3 billion Binance breach reported the previous week and described as the largest cryptocurrency theft on record. A related report said North Korea denied a role in that breach and pointed to the United States.

The next hard checkpoint for BitMart arrives in December or January, when the exchange plans to seek court approval for its user-recovery proposal. Approval would put the liquid-distribution and token mechanisms on a defined legal footing; without it, the proposed wind-down would lack the authorization that plan requires.