Crypto exchange BitMart hacked again — its founder Sheldon Xia confirmed the November 2 attack. He also admitted that the platform's security team is "severely understaffed." Part of the stolen funds went to the same address that appears in the theft of almost $49 million from Brazilian exchange Mercado Bitcoin.
Hot wallets are exchange storage connected to the network. Regular client withdrawals go through them, which is why they most often become the target of an attack.
For a trader, this is about storage. Since July, BitMart has been heading toward closure and still hasn't settled with clients, and now the hack has been added to withdrawal delays.
How much was stolen?
Analytics firm Bitquery counted about $391,000 in suspicious transfers. Mostly these are wallets it links to BitMart, on the Base, Arbitrum and Optimism networks.
- Hot wallets and thousands of deposit addresses — according to Bitquery, the attacker reached them
- Xia did not name the loss amount — BitMart has not published a verified figure
- Compromised wallets not specified — the exchange did not disclose them
Why is the address more important than the amount?
The money went to an address that on the same day was involved in the hack of Brazilian exchange Mercado Bitcoin. There, Bitquery estimates losses at almost $49 million across 10 blockchains.
- Timing. Transfers from wallets linked to BitMart began roughly 53 minutes before the main withdrawal at the Brazilians.
- Access method. Neither platform has yet explained how the attacker gained access.
- Common contractor. It is unclear whether the two exchanges shared a technology provider.
What about the BitMart team?
Xia explained the staff shortage by restructuring. Only a core team remained, and technical specialists had to be persuaded to stay.
Key point: Xia also claimed threats against employees and retaliation from disgruntled laid-off workers. These claims have not been independently confirmed.
What will happen to clients' money?
In July, BitMart announced it would halt trading and close the platform by January 31, 2027. Then came withdrawal delays and account freezes.
- Consultants — the platform is being handled by White & Case and Alvarez & Marsal
- Payout plan — initial settlements in liquid assets, deferred compensation and tokens to repay debt
- Timeline — amendments to the plan are promised in November, with a court filing in December 2026 or January 2027
If you trade crypto without self-custody, check the terms in the prop firm catalog.
Were you holding alts on a small exchange for leverage?
The arithmetic here is familiar. Large platforms offer a narrow list and modest leverage, so some of the money always sits where the terms are sweeter and the risks unclear. With prop firms, trading goes through the company's account, and there are strict limits of their own: somewhere the list has only BTC and ETH, somewhere half the altcoins, somewhere a position cannot be held through the weekend. These lines decide whether a program suits you or not, and you need to read them before paying. Filtering by parameters immediately rules out the ones where your instruments simply aren't traded.