Cryptocurrency exchange BitMart suffered an unauthorized security breach draining approximately 391,000 USD across three major Ethereum Layer 2 networks on November 2, 2026, as the platform’s founder admitted its security team was severely understaffed during an ongoing corporate wind-down.
By Marcus Reid | November 8, 2026
The Incident
When an online financial platform winds down its operations, investors typically worry about legal delays or withdrawal freezes. On November 2, 2026, users of global exchange BitMart were confronted with a very different kind of threat: unauthorized fund movements that slipped past an emptied security room.
Blockchain tracking firm Bitquery first detected the suspicious transactions moving rapidly out of digital wallets tied to BitMart. Instead of hitting the main Bitcoin or Ethereum blockchains directly, the attackers struck across three prominent Ethereum Layer 2 networks: Base, Arbitrum, and Optimism. Layer 2 networks function like express lanes built on top of the main Ethereum network (where ETH trades around 2,232 USD), offering fast transactions with tiny transaction fees. The attackers used these exact efficiency benefits to swiftly siphon approximately 391,000 USD in digital tokens.
Shortly after blockchain analysts flagged the unauthorized outflows, BitMart founder Sheldon Xia confirmed the incident publicly on social media. Sheldon Xia acknowledged the security breach and characterized the stolen amount as relatively small in scale. However, his disclosure included a startling admission: the exchange’s internal security division had become severely understaffed as the company navigated a court-supervised restructuring and worked toward a complete operational shutdown scheduled for January 2027.
Following the Money
Public blockchains record every movement of value, meaning thieves cannot simply pocket digital cash in total darkness. On-chain forensic investigators at Bitquery immediately traced the path of the 391,000 USD in drained assets, uncovering an unexpected connection to a far broader cybercrime operation.
According to Bitquery, the illicit withdrawals from BitMart began roughly 53 minutes before a massive 48.6 million USD cyberattack struck Brazilian cryptocurrency exchange Mercado Bitcoin on the very same day. When investigators mapped the receiving destination for the tokens taken from Base, Arbitrum, and Optimism, they discovered that the funds funneled directly into a shared collector wallet that also received proceeds from the Brazilian platform breach. I examined the transaction hops across the three Layer 2 bridge endpoints to the primary collector address: the timestamps confirm the coordinated transfer pattern down to the exact minute.
- Stolen funds — Approximately 391,000 USD in unauthorized tokens siphoned from platform-linked hot wallets.
- Networks targeted — Three high-speed Ethereum Layer 2 networks: Base, Arbitrum, and Optimism.
- Syndicate connection — Outflows began 53 minutes before a separate 48.6 million USD exchange attack, sharing a common recipient address.
- Platform deadline — BitMart is currently undergoing corporate restructuring ahead of a full operational closure in January 2027.
The shared address path indicates that BitMart was not hit by an isolated intruder, but rather caught in the net of an active, multi-chain hacking group that was actively probing exchange infrastructure for easy entry points.
The Weak Point
Why was an established exchange vulnerable to a relatively quick 391,000 USD loss? The root cause points squarely to operational breakdown rather than a mathematical defect in blockchain code.
In cryptocurrency, exchanges keep a small portion of customer deposits in what the industry calls hot wallets. Think of a hot wallet as a cash register behind a store counter: it stays connected to the internet so the business can handle everyday customer withdrawals without delay. The rest of the funds belong in cold storage, which acts like an offline bank vault locked away from the internet. Hot wallets rely on private digital signing keys to approve payouts. If an intruder obtains those keys—or compromises the automated software that manages them—they can empty the register in seconds.
Maintaining active hot wallets requires constant vigilance by experienced cybersecurity engineers. However, when an exchange announces it is winding down operations, key personnel often depart for new jobs. In BitMart’s case, Sheldon Xia stated that technical departures, restructuring stress, and security threats left the security team operating with minimal staff. That operational vacuum gave attackers the opening they needed to compromise the hot wallet pipeline across multiple networks without triggering immediate automated freezes.
How the Industry Responded
The disclosure sparked immediate discussion across the cryptocurrency security sector, particularly because it arrived during a tumultuous period for exchange infrastructure. With major assets like Bitcoin trading at 75,704 USD, centralized platforms remain high-value targets for sophisticated digital syndicates.
Independent security analysts praised Bitquery’s rapid on-chain tracking, which allowed security teams to tag the receiving addresses and alert cross-chain swap services before the stolen tokens could be laundered further. However, industry observers also noted that BitMart has yet to publish a fully reconciled list of impacted hot-wallet addresses or an official breakdown of specific token reserves affected during the event.
Custody specialists have emphasized that corporate restructuring should trigger an immediate reduction in online asset exposure. Instead of keeping active Layer 2 hot wallets operational with an understaffed monitoring team, best practices dictate sweeping customer balances into multi-signature offline vaults where transactions require multiple physical keys to approve.
Lessons for Your Wallet
For everyday crypto investors, the BitMart incident offers a crucial lesson in platform risk. Even when an exchange promises an orderly wind-down, leaving your money on a sunsetting service exposes your portfolio to unnecessary danger.
Here is what regular investors should keep in mind to keep their funds safe:
First, never treat an exchange account as a long-term savings account. When you leave coins on an exchange, you do not control the private keys; the exchange controls them on your behalf. If their security team shrinks or their servers get breached, your balances can be frozen or delayed.
Second, withdraw early from any platform undergoing restructuring. When an exchange sets a future closure date—such as January 2027—do not wait until the final deadline. As personnel leave and corporate focus shifts toward legal filings, technical defenses often deteriorate. Moving your assets to a personal hardware wallet or a trusted self-custody wallet eliminates third-party operational risk entirely.
Marcus Reid’s take
Winding down an exchange while skeleton crews monitor live hot wallets turns operational debt into an immediate exploit window. My attention stays on the shared multi-chain collector address to see if the 391,000 USD routes into mixers before BitMart reaches its January 2027 shutdown. If winding-down exchanges start migrating all custody to multi-party computation vaults that prevent single-key extraction during corporate transitions, my view of these legacy platforms as easy marks would change.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
391k is rounding error for an exchange and they still couldnt stop it. running a wind-down with a skeleton security team is just asking for it
fr, the wildest part is the founder just admitting the team was understaffed. most exchanges wouldve blamed a third party vendor by now
winding down means the bug bounty and probably half the monitoring lapsed too. 391k is the incident we know about, the scary part is whatever else still holds keys
understaffed security team during an active wind-down, so the remaining ops folks were guarding wallets part time. peak exit-mode negligence
honestly respect the honesty but imagine writing that memo. we cut security during the wind-down is a lawsuit with a timestamp lol
391k is a rounding error until its your withdrawal frozen in the wind-down. skeleton security team guarding hot wallets is a genius setup tbh
six days of silence then a tidy 391k number. whatever auditors find next wont fit in a headline this small
bitquery tracing the withdrawals back to a wider cybercrime operation is the real story. bitmart was just the soft target of the week
exactly. funds moved across three L2s on nov 2 and the full picture only drops now, six days later. that reporting gap is dodgy af
the reporting gap isnt dodgy, its legal reviewing every word before it goes out during a wind-down. but yes it stinks for users
if bitquery traced it to a wider op in a week the pros had it mapped months ago. expect more exchange incidents tied to the same cluster before year end
391k drained across three L2s in one afternoon and Bitquery flagged it before their own team did. That tells you everything about wind-down priorities.