BitMart has become the latest centralized exchange to suffer a security breach, adding to a string of crypto thefts that have marred the industry over the past year. Founder Sheldon Xia confirmed on X that the exchange was hacked on November 2 — the same day Brazil's largest crypto exchange, Mercado Bitcoin, suffered a $48.6 million exploit. In the reply, Xia stated that preliminary investigations point to the attack being conducted by the same group behind the Mercado Bitcoin breach.

The amount stolen from BitMart was relatively small compared with the scale of several major incidents over the past few months. What Xia disclosed about the state of the exchange's security during its winding-down process, however, is harder to ignore.

BitMart Was Hit 53 Minutes Before Mercado Bitcoin

Onchain data from Bitquery showed that the attacker siphoned roughly $391,000 from BitMart-linked wallets on Base, Arbitrum, and Optimism — three of Ethereum's largest layer-2 networks. The outflows began 53 minutes before the attacker moved on to Mercado Bitcoin, which suggests BitMart may well have been the first target. By comparison, the $391,000 taken from BitMart is a small fraction of the $48.6 million Mercado Bitcoin lost in the attack that followed.

Xia's post did not state whether any user balances were impacted, nor did it say whether BitMart plans to cover the losses.

BitMart's Security Team Is Running Thin After the July Wind-Down

BitMart announced in July that it was shutting down its exchange after nine years in the industry, with full closure of operations set for January 31, 2027. Since that announcement, the exchange has kept only a core team, and Xia said the reduction in headcount is now under serious pressure.

He cited doxxing and threats from users, as well as retaliation by some former employees, while also naming the exchange's former head of marketing. Personal attacks, he said, have made it difficult for some technical staff to stay, and he admitted that the security team is "severely understaffed" while attacks keep coming.

Security has been a recurring challenge for the exchange: in December 2021, attackers used a stolen private key to drain roughly $150 million from one of BitMart's hot wallets.

An exchange winding down still holds user data and funds, making it a potential target for attackers looking to exploit security gaps. A smaller engineering team can also mean less oversight of hot wallets — the internet-connected wallets exchanges rely on to process day-to-day withdrawals — and slower responses to security incidents.

Crypto Theft in 2026 Has Passed $8.77 Billion

2026 has been the worst year on record for crypto hacks and thefts. Data from DefiLlama shows that exploits so far this year stand at $8.776 billion, far exceeding any previous year and more than three times the $2.715 billion stolen last year.

Most of this year's total traces back to the $6.3 billion Binance hack from last week, which is the largest single exploit the industry has ever witnessed. The BitMart breach adds to a growing list of centralized exchange incidents in 2026, including Bitget, Binance, and Mercado Bitcoin.

If Xia's assessment of the attackers is correct, one group hit two exchanges on two different continents on the same day — starting with the one that had the fewest people left to defend it.

Xia said the remaining team is still doing everything it can to safeguard data and assets. He has not said how long BitMart expects to keep its core systems running as the wind-down continues.