Source publication: November 6, 2026, at 12:50 UTC+8. This article reflects the information and restructuring timetable reported at that time.
BitMart’s reported security breach on November 2 came while the exchange was assessing its assets and liabilities and developing a restructuring plan for users. The central question was not only how much had moved out of its wallets, but who owned the affected funds and whether the incident would alter proposed distributions to creditors.
According to the original report by QQLink, BitMart founder Sheldon Xia confirmed the breach on November 3. He described the amount involved as relatively limited and said the team had begun investigating and taken security measures. BitMart had not disclosed a final loss figure, the compromised systems, how wallet permissions were obtained, or whether customer assets or personal information were affected.
Blockchain analytics firm Bitquery estimated approximately $391,000 in abnormal transfers involving wallets it associated with BitMart. That estimate was not a confirmed loss disclosure from the exchange, and some of the wallet identifications had not been formally confirmed by BitMart.
What the on-chain evidence showed—and did not show
Bitquery identified unusual transfers on networks including Base, Arbitrum and Optimism. Some funds ultimately reached addresses linked to the separate attack on Brazilian exchange Mercado Bitcoin. The earliest transfers preceded Mercado Bitcoin’s main asset outflows by about 53 minutes.
Those overlaps suggested a possible connection, but did not establish that the same attacker or group carried out both incidents. Shared fund flows alone could not prove who controlled the addresses or how either exchange was breached.
In a November 4 investigation update, Bitquery reported approximately $48.6 million in outflows across 10 blockchains from Mercado Bitcoin wallets on November 2. The attacker appeared to have obtained signing capability for some customer deposit addresses as well as access to exchange hot wallets. On Ethereum alone, balances were moved from 36,042 deposit addresses.
According to the tracking cited in the report, abnormal transfers continued for about four hours after Mercado Bitcoin said it had brought the incident under control.
The apparent reach into deposit addresses raised questions beyond the loss of a single hot wallet. Exchanges must manage deposit addresses, withdrawal-signing systems and internal fund-consolidation processes alongside their pooled wallets. Compromise across several of those functions could expose a wider custody infrastructure.
Possible explanations included leaked private keys, misuse of signing permissions, compromised administrative access or a breach at a third-party infrastructure provider. Public information did not establish which explanation applied to Mercado Bitcoin, and none could be assumed to explain BitMart’s incident.
Why BitMart’s restructuring matters
The report said BitMart announced plans in July 2026 to wind down trading gradually, initially scheduling a trading halt for August before turning to restructuring options. Under its preliminary plan, the platform was assessing its financial position with participation from professional firms including Alvarez & Marsal and White & Case. Management sought a court-approved arrangement offering users different ways to resolve their claims.
According to platform disclosures cited in the article, management attributed financial pressure to weaker market conditions in 2026, falling trading revenue and abuse of some trading-incentive mechanisms.
The report also cited BitMart’s December 2021 security incident, for which the platform estimated losses of approximately $319.5 million. It said the incident depleted digital-asset reserves and created a balance-sheet shortfall.
Against that background, the November breach was not simply an isolated operational loss at an otherwise normally functioning exchange. It occurred while the platform’s finances were under pressure and arrangements for customer assets remained unresolved.
Xia acknowledged that BitMart retained only a core team during restructuring and that its security team was severely understaffed. He linked staff departures to online threats, exposure of employees’ personal information and internal disputes. The report did not establish that those circumstances caused the breach.
The operational concern nevertheless remained: suspending trading does not eliminate the need to maintain wallet controls, monitor transfers, patch systems or protect customer records.
Customer balances would become claims under the preliminary plan
BitMart’s proposed restructuring would convert customer account balances into U.S. dollar-denominated claims. The options described in the report included:
- A proportional distribution of existing liquid assets. This could offer an earlier exit, but the amount received would depend on the assets available for distribution.
- Restitution Token. This would provide participation in recoveries of historically stolen assets, with uncertain recovery outcomes and timing.
- Continuum Token. This would provide participation in proceeds from platform investments, disposals of illiquid assets and potential future earnings. Its value would depend on future realizations and the conditions for resuming some business activity.
These were preliminary proposals, subject to user consultation, revision and court approval. At the time of the report, BitMart expected to seek approval from the relevant court between December 2026 and January 2027. That timetable was not a promise that customers would be able to withdraw funds or recover their balances in full during that period.
The latest incident could add uncertainty to the process. It did not, by itself, establish that customer claims had been reduced, nor did it explain all assets users had previously been unable to withdraw.
The unresolved custody and liability questions
To assess the consequences, BitMart still needed to identify the affected wallets, explain how transfer authority was compromised and clarify whether the funds belonged to the platform or involved customer accounts. It also needed to disclose whether the incident changed its proposed asset-distribution arrangements.
On-chain transfers can help establish where assets moved. They do not, on their own, establish legal ownership, the exchange’s total liabilities or the amount ultimately available to creditors.
The Mercado Bitcoin response also illustrated the limits of recovery tools. The report said Bitquery continued tracing funds while Tether, Circle and Paxos froze some related assets. Such intervention can assist recovery, but does not mean all stolen assets can be returned. Bitcoin and ether cannot be frozen directly by a single issuer in the way centrally issued stablecoins can; recoveries still depend on fund movements, counterparties and judicial cooperation.
For BitMart, the reported $391,000 in abnormal transfers was substantially smaller than the Mercado Bitcoin outflows or the exchange’s own reported 2021 loss. Its significance lay in the unresolved custody obligations surrounding it. Until assets and claims are settled, maintaining security controls and explaining their failures remain part of the platform’s responsibility—not optional costs that disappear when trading stops.