BitMart has become the latest centralized crypto exchange to face a security breach. The incident adds to growing concerns about exchange security as crypto thefts continue to mount in 2026.
The breach also raises questions about the risks facing platforms that have announced plans to shut down. BitMart founder Sheldon Xia says preliminary investigations point to the same group behind Mercado Bitcoin’s recent $48.6 million exploit.
BitMart hack occurred 53 minutes before Mercado Bitcoin breach
Xia confirmed the BitMart hack in a post on X on November 2. He said preliminary investigations suggest the attackers belonged to the same group responsible for the Mercado Bitcoin breach. The Brazilian exchange lost approximately $48.6 million in the separate incident.
Onchain data from Bitquery showed that attackers siphoned approximately $391,000 from BitMart-linked wallets. The affected wallets operated across Base, Arbitrum and Optimism.
Notably, the BitMart outflows began 53 minutes before attackers moved against Mercado Bitcoin. This timeline suggests BitMart may have been the group’s first target that day. It also raises the possibility that the attackers coordinated breaches against two centralized exchanges on different continents.
However, Xia did not disclose whether the stolen funds affected customer balances. He also provided no details about whether BitMart would compensate users for the losses.
BitMart security team faces staffing challenges during wind-down
The breach comes as BitMart continues its planned shutdown after nine years of operations. The exchange announced its closure in July, with full operations scheduled to end on January 31, 2027.
Since announcing the wind-down, BitMart has retained only a core team to manage its remaining operations. However, Xia says mounting pressure has made it increasingly difficult to retain technical staff.
In his X post, Xia cited doxxing, user threats and retaliation from some former employees. He also named the exchange’s former head of marketing while discussing the internal tensions.
According to Xia, personal attacks have made it harder for some technical employees to remain with the company. He also acknowledged that BitMart’s security team is “severely understaffed” despite continued attacks.
The staffing situation raises concerns about how exchanges manage security during prolonged shutdowns. Platforms winding down still need to protect customer funds, personal information and critical infrastructure.
A reduced engineering workforce can also create challenges for wallet monitoring and incident response. Consequently, security gaps may become harder to identify and address as exchanges scale back operations.
Xia said the remaining employees continue working to protect BitMart’s data and assets. However, he has not disclosed how long the exchange expects to maintain its core systems.
Crypto theft reaches $8.77 billion in 2026
The BitMart incident adds to a difficult year for cryptocurrency security. DefiLlama data puts total crypto exploits in 2026 at approximately $8.776 billion.
That figure already exceeds every previous annual total and stands more than three times above 2025’s $2.715 billion. However, much of the 2026 figure comes from the reported $6.3 billion Binance hack last week.
The Binance incident ranks as the largest single exploit in the industry’s history. Meanwhile, other centralized exchanges, including Bitget and Mercado Bitcoin, have also faced security incidents this year.
BitMart’s $391,000 loss represents a smaller breach by comparison. Nevertheless, Xia’s assessment suggests the same attackers may have targeted two exchanges within less than an hour.
The incident also highlights the security challenges facing exchanges during operational wind-downs. BitMart must now address the breach while maintaining its remaining systems and protecting customer assets through its planned January 2027 closure.
