BitMart founder Sheldon Xia confirmed a security breach after Bitquery traced about $391, 000 in outflows from wallets linked mostly to the exchange to an address used in the Mercado Bitcoin attack. The link is a lead, not proof that the same attackers hit both exchanges.
- Xia confirmed BitMart was hacked on November 2.
- Bitquery’s $391, 000 figure is a tracing estimate, not a loss total confirmed by BitMart.
- Neither the attack method nor BitMart’s loss estimate has been disclosed.
- Chainalysis estimated Mercado Bitcoin’s stolen funds at $49 million; its reported freeze totals vary.
A transaction link, not a confirmed attribution
On November 3, Xia wrote on X: “Yes, we got hacked yesterday too, ” describing the amount involved as small. He said BitMart had investigated and strengthened security measures, but did not disclose what changes the exchange made.
Bitquery reported that about $391, 000 moved from wallets it associated mostly with BitMart to an address used in the Mercado Bitcoin incident. The firm’s account does not explain how it attributed each wallet to BitMart or describe its tracing method. The figure reflects reported outflows, not a loss estimate confirmed by the exchange.
Xia said BitMart’s preliminary investigation suggested the same group might be behind both incidents. But a transaction path linking addresses does not show who controlled them, let alone prove the same people carried out both attacks. Bitquery’s reported evidence connects transactions, but does not confirm who was responsible.
BitMart has not publicly explained how its wallets were accessed or estimated its losses from this breach. The reports date both incidents to November 2, but do not specify the year.
Mercado Bitcoin figures remain unsettled
Chainalysis estimated that attackers stole about $49 million from Mercado Bitcoin across 17 blockchains. The firm’s account describes freezes reaching $9 million, while its overview puts the amount at nearly $10 million. The supplied figures do not explain the difference.
Mercado Bitcoin has separately said that about $38 million in assets were involved and around $11 million had been blocked with help from industry partners. Those totals differ from Chainalysis’s estimates, and the available information does not reconcile them. “Assets involved, ” “stolen, ” and “blocked” could refer to different scopes or stages, but that cannot be assumed without more detail. Each figure should be treated as the estimate from the organization that reported it. Mercado Bitcoin’s cyberattack losses and customer impact remain unclear.
Chainalysis said the stolen assets moved across multiple networks, including Bitcoin, Ethereum, Base, Tron, and Polygon. It also said it contacted Paxos, Anchorage Digital, Ripple, Circle, and Tether as it coordinated with law enforcement and other organizations. Chainalysis specifically reported that Tether froze more than $4 million in stolen funds. It did not say that every organization it contacted froze assets.
Tracing funds and freezing them are not the same as recovering them. Public blockchains make transfers visible, but following the money does not automatically return it to customers. A freeze can restrict certain assets, often through an intermediary able to intervene, but it does not mean customers have been repaid.
Mercado Bitcoin temporarily suspended deposits and withdrawals after identifying a security incident in one of its systems. The exchange said customers would not bear the financial losses. It later repeated that assurance while absorbing about $40 million in losses. That assurance is separate from the funds Chainalysis and Mercado Bitcoin said had been blocked.
BitMart’s separate history of losses
The November breach is separate from BitMart’s December 2021 security breach. CryptoBriefing reported that the earlier incident depleted about $319.5 million in digital assets. That loss offers context for BitMart’s financial challenges, but does not establish the scale or cause of the newer breach.
BitMart has also been described as pursuing a restructuring and customer-recovery process. Available reporting describes its proposal as preliminary, not a final or guaranteed repayment plan. Since the year of the November breach is unspecified, its timing relative to the restructuring developments cannot be established from the dates reported.
Key questions
-
Did BitMart confirm a breach?
Yes. Sheldon Xia said on X that BitMart had been hacked on November 2. The reports do not specify the year.
-
Does the $391, 000 figure confirm BitMart’s loss?
No. Bitquery reported outflows from wallets it linked mostly to BitMart. The exchange has not confirmed its loss total.
-
Were the same attackers behind both incidents?
That remains unconfirmed. Xia raised the possibility, but the reported transaction link does not prove common control or common perpetrators.
-
How much was stolen from Mercado Bitcoin?
Chainalysis estimated about $49 million. Mercado Bitcoin reported about $38 million in assets involved, and the figures have not been reconciled.
-
Does freezing funds mean customers have been repaid?
No. A freeze can stop some assets from moving, but it is not the same as returning funds to customers.
The blockchain trail deserves investigation, but it does not establish who was responsible. BitMart’s loss estimate, how its wallets were accessed, and the year of the breach remain undisclosed in the available reporting.
