The transfers went to an attacker-controlled address also involved in the November 2 breach of Brazilian exchange Mercado Bitcoin, raising the possibility that the two incidents are connected. Bitquery cautioned that its wallet labels do not independently prove ownership, while neither exchange has established how the attacker obtained access.
How Much Was Taken From BitMart?
Bitquery’s investigation found that suspicious transfers associated mainly with BitMart-linked wallets began roughly 53 minutes before the main Mercado Bitcoin drain. One of the receiving addresses was subsequently used during the much larger Brazilian exchange attack.
BitMart has confirmed that it suffered an attack, strengthening the case that at least some of the suspicious transactions involved the exchange. It has not, however, published a reconciled loss figure or identified the compromised wallets.
That distinction matters because Bitquery’s approximately $391,000 figure relies partly on blockchain attribution. The analytics firm specifically said it had not independently confirmed that all of the wallets it identified belonged to BitMart.
The suspected connection is potentially more consequential than the dollar amount. Bitquery’s updated investigation estimated that Mercado Bitcoin lost close to $49 million across 10 blockchains, with the same attacker address receiving the earlier BitMart-linked transfers.
Investigators have not established whether the apparent overlap resulted from the same attacker compromising both exchanges, shared wallet infrastructure, a common third-party provider or another connection.
Investor Takeaway
The approximately $391,000 loss is small relative to major exchange hacks, but the potential shared infrastructure or attacker link with Mercado Bitcoin is the more important issue. Establishing how access was obtained will determine whether the incidents represent isolated compromises or a wider operational vulnerability.
Why Is BitMart’s Security Team Understaffed?
Xia tied the staffing shortage to BitMart’s restructuring, saying the company retained only a core team and had difficulty persuading technical personnel to remain.
He also alleged that threats against employees and retaliation by dissatisfied former staff had made retention more difficult. Those claims have not been independently verified.
“It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems,” Xia said, adding that the exchange continues to face numerous attacks while its security team is “severely understaffed.”
The disclosure creates an unusual risk profile for an exchange that is simultaneously maintaining wallets and processing a restructuring. Cybersecurity controls depend not only on software but also on personnel capable of monitoring alerts, rotating compromised credentials, managing wallet infrastructure and responding to incidents.
Investor Takeaway
BitMart’s staffing disclosure makes operational capacity part of its restructuring risk. Even a relatively small breach becomes more consequential when the company acknowledges that the team responsible for defending remaining systems is materially understaffed.
How Does the Hack Affect BitMart’s Restructuring?
BitMart originally announced plans in July to end trading and close its platform by January 31, 2027. Withdrawal delays and frozen accounts subsequently generated questions over how customers would recover assets held on the exchange.
The company later shifted toward a possible restructuring rather than a straightforward wind-down. BitMart said it was considering a phased resumption of some operations alongside creditor distributions, with White & Case and Alvarez & Marsal advising on the process.
Its latest indicative plan offers users different recovery paths, including upfront distributions of available liquid assets and alternatives involving deferred recoveries and recovery-linked tokens. BitMart expects to adjust the plan during November before targeting a court application in December 2026 or January 2027.
The company has previously faced public disputes over withdrawals and its financial condition, including allegations from users and projects with inaccessible balances. OpenGradient’s co-founder alleged in August that BitMart was insolvent, an allegation the exchange has not accepted.
What Should Users Watch Next?
The immediate questions are whether BitMart publishes a definitive loss figure, identifies the compromised infrastructure and explains whether any customer assets were affected.
The possible Mercado Bitcoin connection also requires further forensic evidence. Bitquery found that the Mercado Bitcoin attacker obtained access not only to hot wallets but also to thousands of deposit addresses, suggesting extensive control over signing infrastructure. Whether BitMart shared any technology or service provider with Mercado Bitcoin has not been established.
Investor Takeaway
For BitMart creditors, the main concern is less the standalone size of the latest hack than whether further security losses could reduce assets available during restructuring. A technical explanation of the breach and updated asset reconciliation would therefore be more meaningful than the initial description of the loss as small.
