BitMart Hacked Again While Winding Down: $391K Stolen 53 Minutes Before Mercado Bitcoin's $48.6M Hit — What Happens to Users' Funds Now

BitMart was hacked again on November 2, 2026 — and this time the exchange barely had a security team left to stop it. About $391,000 was drained from BitMart wallets on Base, Arbitrum and Optimism just 53 minutes before the same attacker-controlled addresses struck Brazil's Mercado Bitcoin for an estimated $48.6 million. BitMart founder Sheldon Xia confirmed the breach a day later, admitting his security team is "severely understaffed" while the exchange winds down under court supervision with a $319.5 million shortfall already on its books. If you still have funds sitting on BitMart — or on any exchange that is shrinking, restructuring or quietly winding down — this is the warning sign you cannot afford to ignore.

The small size of the BitMart theft is exactly what makes it alarming. Attackers did not need a sophisticated zero-day or a nine-figure exploit to rob an exchange in the middle of a court-supervised wind-down. They needed less than an hour, three Ethereum layer-2 networks, and a target whose defences had already been hollowed out by months of restructuring. And the on-chain trail suggests BitMart was not even the main target: it looks like a warm-up act, hit 53 minutes before the main event.

What happened on November 2: the 53-minute warning nobody acted on

According to blockchain analytics firm Bitquery, attackers drained roughly $391,000 from wallets linked to BitMart across Base, Arbitrum and Optimism — all three Ethereum layer-2 networks. Bitquery labelled the Arbitrum and Optimism source wallets as BitMart hot wallets, and an Arbiscan record shows a wallet labelled "BitMart 21" sending ether to the same address that subsequently received 2,852.07 ETH from the Ethereum hot wallet Bitquery identified as Mercado Bitcoin's, as detailed in Cryptonews' report on the breach. Both sets of transactions occurred on November 2, with the BitMart outflows beginning about 53 minutes before the first Mercado Bitcoin funds moved.

On November 3, Xia confirmed the breach in a post on X after blockchain transactions surfaced showing funds moving from wallets associated with the exchange to an address linked to the Mercado Bitcoin exploit. His words were blunt: "Yes, we got hacked yesterday too. The amount involved was small, and we acted quickly to investigate and strengthen security." He added that the security team is "severely understaffed" but still doing everything it can to safeguard data and assets.

What Xia did not do is equally telling. His statement did not quantify the loss, identify the affected systems, or say whether customer balances, deposits or withdrawals were affected. The $391,000 figure comes from independent on-chain analysis, not from BitMart itself. That gap between what the blockchain shows and what the exchange discloses is a pattern users of troubled exchanges should learn to recognise: when an exchange in restructuring says "small", verify it on-chain before believing it.

The Mercado Bitcoin connection: one attacker, two exchanges, one afternoon

The link between the two incidents rests on on-chain patterns, not formal attribution — and that distinction matters. Bitquery traced BitMart-linked outflows to the same attacker-controlled addresses involved in the Mercado Bitcoin incident. BitMart's own preliminary investigation reached the same conclusion, with Xia saying the November 2 breach may have been carried out by the same group behind the Mercado Bitcoin hack. But no authority has formally named the attackers, and the shared-address evidence proves the funds flowed to the same destination, not who controlled the keys.

Mercado Bitcoin's own numbers differ from the researchers' totals, which is normal in the first days after an exploit. The Brazilian exchange said on November 3 that affected assets were then worth about $36.3 million, and that it had blocked roughly $12.9 million with assistance from partners; other reports put the frozen figure at around $11 million. On-chain researchers, meanwhile, estimated total losses at around $48.6 million. The gap likely reflects different counting methods — what was moved versus what was ultimately lost after freezes — and the true net loss will only settle once the tracing is complete. Either way, the scale dwarfs BitMart's $391,000, which is precisely why investigators believe BitMart was a test run: a small, lightly defended target used to validate access, tooling or laundering routes before the main strike. For the full breakdown of the larger attack, see our earlier report on the Mercado Bitcoin hack and what to do if your exchange freezes withdrawals.

The sequence also fits a grim pattern in 2026's hack landscape. This has been a record year for exchange theft — from the $6.3 billion Binance heist in late October, which we covered in our Binance hack explainer, to a string of smaller exchange and bridge exploits. Attackers are not only chasing the biggest vaults; they are systematically probing the weakest ones. A winding-down exchange with a skeleton security crew is, by definition, one of the weakest vaults in the industry.

Why BitMart was so vulnerable: a wind-down, a skeleton crew, and a $319.5 million hole

BitMart was not operating at full strength when the attack landed — it was barely operating at all. The Cayman Islands-based exchange announced its wind-down on July 26, 2026, and halted all trading by August 26, 2026. Since then it has been working through a restructuring under court supervision, aimed at a repayment plan for users whose funds remain on the platform. Users have complained about withdrawal problems during that process, and in a separate restructuring update Xia said advisers had met with the top 50 users who still held funds there.

The restructuring itself traces back to a much older wound. On December 4, 2021, BitMart's hot wallets on Ethereum and BNB Smart Chain were hacked for an estimated $150 million to $196 million. Restructuring documents note a projected shortfall of $319.5 million based on 2021 pricing — including approximately $164.1 million in Ethereum, $96.5 million in BNB and $51.5 million in Bitcoin — and that figure sits at the centre of the repayment plan BitMart is seeking court approval for. In other words, BitMart entered its wind-down already hundreds of millions short, then cut the very security staff whose job was to protect whatever remained.

That is the part of this story every crypto user should internalise. An exchange in wind-down does not become safer because it stops trading. It becomes more dangerous, because revenue stops, staff leave, security budgets shrink, and the remaining wallets still hold real customer money. Attackers know this. The November 2 incident is evidence they are now actively hunting wind-down targets, not just opportunistic ones.

Timeline: how BitMart went from hacked exchange to hacked wind-down

Date	What happened	Why it matters
December 4, 2021	BitMart hot wallets hacked for an estimated $150–196 million	Created the shortfall that still drives today's restructuring
July 26, 2026	BitMart announces it will wind down exchange operations	Trading's end begins; revenue and staffing start shrinking
August 26, 2026	All trading halted; court-supervised restructuring begins	Users left waiting on a repayment plan, not a trading venue
November 2, 2026	$391,000 drained from BitMart wallets on Base, Arbitrum and Optimism	Second hack, 53 minutes before the Mercado Bitcoin attack
November 3, 2026	Founder Sheldon Xia confirms the breach on X; admits security team "severely understaffed"	First public admission; no loss figure or customer-impact statement
November 2026	BitMart expects to adjust its restructuring proposal	Terms for remaining users could still change
December 2026 – January 2027	Management targets court applications over the repayment plan	The date by which users may finally learn what they recover

What happens to users' funds now?

BitMart's initial indicative restructuring proposal offers users a choice of upfront distributions or tokens tied to potential recoveries and other assets. That is a very different proposition from "your money is safe and withdrawable": an upfront distribution typically means accepting a haircut now, while recovery-linked tokens mean betting that future recoveries — from frozen funds, litigation or asset sales — will eventually make you whole. Neither option is a withdrawal. Both depend on a court process that BitMart only expects to reach the application stage in December 2026 or January 2027.

The November 2 hack complicates that maths in two ways. First, every dollar drained from remaining wallets is a dollar that cannot be distributed to users, widening a shortfall that already stands at $319.5 million on 2021 pricing. Second, it raises an uncomfortable question for the court and for creditors: if the security team is severely understaffed, what prevents a third incident before the plan is approved? Users with funds still on the platform should be asking that question in writing, through official creditor channels, rather than waiting for another X post.

There is a broader lesson here that goes beyond one exchange. When an exchange announces a wind-down, the rational move is to withdraw immediately — not to wait for the repayment plan, not to hope the wind-down is orderly, and not to assume a skeleton crew can defend wallets that full teams could not. Our guide to what happens to your crypto if an exchange goes bankrupt explains why users in these processes are usually unsecured creditors, not owners of segregated assets, and why recovery rates in past cases have been far below 100 cents on the dollar. If you still hold coins on any exchange that has halted trading, announced restructuring or restricted withdrawals, treat every day they sit there as risk you are choosing to carry.

7 checks if your funds are stuck on a winding-down exchange

Use this checklist before you decide to wait, withdraw or accept a restructuring offer:

1. Withdraw first, ask questions later. If withdrawals are still open on any winding-down platform, move your coins to a wallet you control immediately. A functioning withdrawal window during a wind-down is a gift with an unknown expiry date.
2. Document everything today. Screenshot your balances, transaction history, deposit addresses and every official announcement. If the platform later restricts access, your own records become your claim.
3. Never accept a "recovery token" without reading the terms. Tokens tied to future recoveries can be worthless if recoveries fail. Compare the upfront distribution against a realistic recovery scenario, not the headline token quantity.
4. Join the official creditor process. Register your claim through the court-supervised process, not through Telegram groups or unofficial forms. Scammers target wind-down victims aggressively — see our checklist on fake refund traps after major hacks.
5. Assume no insurance covers you. Crypto on an exchange is not covered by bank deposit insurance, and most exchanges' own insurance — where it exists — covers only narrow cases. Our report on why crypto has no bank safety net sets out exactly what is and is not protected.
6. Move what you recover to self-custody. Once funds reach you, do not leave them on another exchange "for now". Our guide to storing crypto safely with cold storage and seed phrases walks through the setup step by step.
7. Watch for the next incident, not just the last one. A second hack during a wind-down is a signal, not an anomaly. If a platform is hacked while shrinking, treat further incidents as likely until it proves otherwise with audits, not assurances.

What most people get wrong about "small" hacks

The most dangerous reaction to the BitMart news is to shrug at $391,000. In a year when single heists have topped $6 billion, a sub-million theft looks like a rounding error. That reading misses three things. First, $391,000 was drained from an exchange that was already hundreds of millions short — for its remaining users, every dollar of new loss lands on an already-impaired recovery. Second, small hacks are often reconnaissance: attackers test keys, tooling and laundering paths on a soft target before deploying them against a large one, and the 53-minute gap to Mercado Bitcoin fits that pattern uncomfortably well. Third, the admission matters more than the amount. A founder publicly stating that his security team is severely understaffed, days after a breach, is a disclosure most exchanges would fight to avoid — and it tells you more about the platform's real defences than any marketing page ever will.

There is also a market-context point worth making honestly. Bitcoin traded around $76,600 to $77,300 on November 4, with the crypto Fear and Greed Index at 34 — still in "fear" — and US spot Bitcoin ETFs having shed about $1.04 billion across just two sessions. None of that caused the BitMart hack, and no honest article should claim otherwise. But fearful markets and shrinking exchanges feed each other: outflows pressure platforms, pressure accelerates wind-downs, and wind-downs create the soft targets attackers exploited on November 2. Security failures and market stress are separate stories that keep colliding in 2026.

What to watch next

Three dates and disclosures will decide whether this story ends as a footnote or a creditor disaster. First, BitMart's adjusted restructuring proposal, expected during November: watch whether the upfront distribution terms change after the new loss. Second, the December 2026 or January 2027 court applications: that is when the repayment plan becomes a legal reality rather than an indicative offer. Third, any statement from BitMart quantifying the November 2 loss and its impact on customer balances — the absence of that statement, weeks after the event, would itself be information. On the Mercado Bitcoin side, watch how much of the blocked $11–13 million is ultimately returned, and whether investigators formally attribute either attack. Until then, treat the shared-address link as strong on-chain evidence, not a proven identity — and treat any exchange in wind-down as a place your coins should not be.

FAQs

How much was stolen in the BitMart hack?

On-chain researchers at Bitquery estimated about $391,000 was drained from BitMart-linked wallets on Base, Arbitrum and Optimism on November 2, 2026. BitMart itself has not published its own loss figure, describing the amount only as small.

Is the BitMart hack connected to the Mercado Bitcoin hack?

On-chain evidence points that way: BitMart-linked outflows went to the same attacker-controlled addresses involved in the Mercado Bitcoin incident, beginning about 53 minutes earlier, and BitMart's own preliminary investigation reached the same conclusion. But the connection is not formally confirmed attribution, and no attacker has been publicly identified.

Is BitMart still operating?

No. BitMart announced its wind-down on July 26, 2026, halted all trading by August 26, 2026, and is now in a court-supervised restructuring aimed at a repayment plan for users with funds remaining on the platform.

What happens to my money if it is still on BitMart?

Under the indicative proposal, users choose between upfront distributions and tokens tied to potential recoveries. The plan still needs court approval, targeted for December 2026 or January 2027, and the $319.5 million shortfall from the 2021 hack means full recovery is far from guaranteed. Register your claim through the official creditor process and keep your own records.

Why is a "small" hack during a wind-down so dangerous?

Because it proves the remaining defences can be breached by a skeleton crew's watch, because every new dollar lost widens an existing shortfall, and because small breaches are often test runs for larger attacks — as the 53-minute gap before the Mercado Bitcoin hit suggests.

How do I protect my crypto from exchange hacks?

Keep only trading funds on exchanges, move the rest to a wallet you control, use a hardware wallet for larger holdings, verify withdrawal addresses before sending, and never trust "refund" links sent after a hack. Our guides to crypto wallets for beginners and buying Bitcoin safely as a beginner cover the basics step by step.

Conclusion

BitMart's second hack is small in dollars and enormous in warning value. An exchange with a $319.5 million hole, a severely understaffed security team and a court-supervised wind-down was robbed again — 53 minutes before the same addresses hit a far bigger target. The victims are not just the users whose coins were in the drained wallets; they are everyone still waiting on a repayment plan that just got a little harder to fund. If your crypto still sits on an exchange that has halted trading, announced restructuring or admitted its defences are thin, the BitMart story is your exit signal. Withdraw what you can, document what you cannot, and never mistake a quiet wind-down for a safe one.

Sources: Crypto.news, Cryptonews and Crypto Briefing reporting on BitMart's November 2 breach and founder Sheldon Xia's November 3 confirmation; Bitquery on-chain analysis of the $391,000 outflows and the 53-minute link to Mercado Bitcoin; Mercado Bitcoin's November 3 statement on affected and blocked assets; CoinGecko market data for November 4, 2026. Figures for the 2021 hack and the $319.5 million shortfall are from BitMart restructuring documents as reported.