BitMart says it was hacked too, a day after Mercado Bitcoin's $38 million incident

What BitMart's founder said

Both Chinese-language outlets carried the same points from Xia's post:

• BitMart was "also" attacked "yesterday", meaning 3 November.
• The amount involved was small. No figure was given.
• The team moved quickly to investigate and reinforce its defences.
• Preliminary findings suggest the attack may have been carried out by the group suspected of attacking Mercado Bitcoin.

That is the full extent of what has been reported. Neither outlet gave a loss amount, the assets or chains affected, how the attackers got in, or whether customer balances were touched. ChainCatcher's item also describes BitMart as an exchange that has announced it is shutting down and is pushing ahead with restructuring and liquidation. We did not find a BitMart statement on that status during this run, so treat it as ChainCatcher's description.

The link to Mercado Bitcoin is a preliminary view from one side. Mercado Bitcoin has not commented on it in anything we opened, and no on-chain analyst has yet published a trace connecting the two incidents. "Same group" here means the founder's working assumption, not a finding.

Sources: Odaily newsflash, 12:18 SGT, 4 November.

ChainCatcher newsflash, 12:07 SGT, 4 November.

Timeline (SGT)

Mercado Bitcoin: the numbers so far

Mercado Bitcoin, which Decrypt calls Brazil's largest crypto exchange, detected a breach early on 2 November and suspended deposits and withdrawals. The loss estimates differ depending on who is counting.

The exchange's own frozen figure rose from $11 million to $12.9 million between updates, an increase of $1.9 million. On the exchange's own latest figures, $12.9 million of $36.3 million is frozen, about 36%. Decrypt notes that the exchange has not said whether its total includes the frozen amount, so that share is an approximation.

The gap between $36.3 million and Chainalysis's $49 million is large. The two may be measuring different things (current value against value at the time of transfer, or a different set of addresses), and none of the sources reconciles them. ChainCatcher, citing Bitcoin.com News, says the exchange's $38 million and Arkham's estimate of more than $46 million had not been reconciled.

Sources: Decrypt, 3 November.

ChainCatcher on the $12.9 million freeze.

Odaily on Arkham's $11.45 million observation.

How the Mercado Bitcoin attack worked, as far as anyone knows

Mercado Bitcoin has not said how the attackers got in. ChainCatcher, citing Bitcoin.com News, reports that preliminary analysis suggests the attacker may have controlled the signing credentials used to authorise transactions. Bitquery's analysis, in the same report, puts the suspicious transfers on Ethereum, Bitcoin, Solana, Stellar, Arbitrum, Tron and Polygon.

Arkham's latest observation, carried by Odaily at 12:57 SGT on 4 November, is that the attacker has started selling, with about $11.45 million of altcoins moved to several different addresses. Selling matters for recovery. Each swap and each new address adds a step that analysts and issuers have to follow before anything can be frozen.

"Signing credentials" is the key phrase if it holds. A thief who controls the keys or approval process behind an exchange's hot wallets does not need to break any blockchain. Each transfer looks valid on chain. That is also why freezes come only from token issuers such as Tether and Circle, and only for their own tokens.

Source: ChainCatcher, citing Bitcoin.com News, 09:40 SGT 4 November.

Is this connected to Binance?

Nobody in our sources has said so. Decrypt points out that Mercado Bitcoin's breach came days after the theft of more than $6 billion from Binance on 29 October, which the FBI attributed to North Korea's TraderTraitor group, and that Mercado Bitcoin has not linked its incident to that attack. BitMart's founder linked his platform's incident to Mercado Bitcoin's, and to nothing else.

Three exchange incidents in a week will tempt people to assume a single campaign. The evidence published so far does not support that. Our report on North Korea's denial of the Binance hack covers what the FBI and analysts have said about that case.

What this means for you

If you have an account on Mercado Bitcoin. The exchange says client assets are guaranteed and balances remain recorded in each account. Its platform and app stay suspended until security is confirmed, and Decrypt reports no restart date. Practical steps:

• Note your balances from the last screen you can access, with the date. If the app is down, keep your most recent statement or email confirmation.
• Do not send new deposits to any Mercado Bitcoin address you saved before 2 November. Deposits are suspended, and an old address may no longer be monitored when service returns.
• If a withdrawal was pending on 2 November, keep its reference and, if it reached the chain, the transaction ID.
• Take updates from the exchange's official X account, which Decrypt says is where it will post.

If you have an account on BitMart. Very little is public. The founder has not said whether customer funds were affected.

• Log in only by typing the address you already use. Do not follow links from messages about the hack.
• Check your balances and recent withdrawal history for anything you did not initiate.
• If BitMart is winding down, as ChainCatcher describes, watch its official announcement channels for any withdrawal deadline. We could not confirm one.

For everyone. Every large hack is followed by fake "compensation" and "recovery" offers. Neither Mercado Bitcoin nor BitMart has announced a claims process in anything we read. A direct message offering to return funds, asking for a fee or a seed phrase, or linking to a look-alike site is a scam.

What to watch next

• A loss figure from BitMart. "Small" is not a number.
• Any on-chain trace from Arkham, Chainalysis or another firm that connects BitMart's incident to Mercado Bitcoin's addresses. That would turn the founder's assumption into evidence.
• Mercado Bitcoin's next frozen-asset update and a restart date for deposits and withdrawals.
• Where the altcoins Arkham saw moving end up, and whether any of them reach an exchange deposit address that can be flagged.

Quick answers

How much did BitMart lose?

BitMart has not said. Founder Sheldon Xia described the amount only as small, according to Odaily and ChainCatcher.

Was it the same hacker as Mercado Bitcoin?

That is the founder's preliminary view. No independent on-chain trace linking the two has been published in what we opened.

Are Mercado Bitcoin customers covered?

The exchange says client assets are guaranteed and balances remain in each account. It has not given a date to resume deposits and withdrawals.

How much has been frozen?

Mercado Bitcoin's latest update puts frozen assets at $12.9 million, up from $11 million. Tether separately froze more than $4.5 million in USDT tied to the incident.

What we could not confirm

We could not open Sheldon Xia's original post or Mercado Bitcoin's posts on X directly; their contents come from Odaily, ChainCatcher and Decrypt. Foresight News, which also reported the BitMart statement, returned an error during this run. We found no BitMart statement on its shutdown status, no figure for its loss, and no published link between its attacker and Mercado Bitcoin's beyond the founder's remark.