Shared On-Chain Traces Link BitMart and Mercado Bitcoin Exploits
A recent series of unauthorized cryptocurrency transfers has revealed potential operational links between attacks on crypto exchange BitMart and Brazil-based trading platform Mercado Bitcoin. According to preliminary investigative findings shared by Xia, the same malicious group may be responsible for targeting both digital asset platforms. Independent blockchain analysis demonstrates that both incidents routed stolen capital through a shared receiving address, although the on-chain data alone does not confirm the precise identities of the attackers or uncover the specific attack vectors used to breach internal systems.
Blockchain analytics firm Bitquery reported that approximately $391,000 in digital assets was siphoned across layer-2 networks Base, Arbitrum, and Optimism, with almost all of the funds originating from wallets it identified as belonging to BitMart. The anomalous movement was detected just 53 minutes prior to the first unauthorized transfers from Mercado Bitcoin. Bitquery categorized the compromised source wallets on Arbitrum and Optimism as BitMart hot wallets, while tracing the affected Base wallet through prior transaction histories associated with BitMart’s published proof-of-reserves data. However, the analytics firm noted that BitMart has not independently confirmed ownership of these designated addresses, leaving the $391,000 calculation as an analytical estimate rather than an exchange-verified loss figure.
Transaction Data Confirms Common Destination Wallet
On-chain records further document the overlap between the two platform breaches. According to Arbiscan ledger data, a wallet designated as “BitMart 21” transferred ether directly to the same recipient address that subsequently accepted 2,852.07 ETH originating from an Ethereum hot wallet that Bitquery identified as Mercado Bitcoin’s. Both of these transactions transpired on Nov. 2.
Following the exploit, Mercado Bitcoin announced on Nov. 3 that the total assets impacted by the security breach were valued at roughly $36.3 million, though the platform successfully intervened to block $12.9 million of the targeted sum. Mercado Bitcoin stated that user balances remain documented and guaranteed under exchange protections, while core platform services were temporarily suspended to contain the threat and secure infrastructure.
Bitcoin Approaches $78,000 in V-Shaped Rebound as Midterm Election Uncertainty Clears
Security Strains Amid BitMart’s Operational Restructuring
The security incident arrives at a vulnerable juncture for BitMart, which announced an operational wind-down in July before pivoting toward an alternative restructuring framework. That proposed strategy encompasses a potential phased restart of trading services alongside structured distributions to outstanding creditors. The ongoing restructuring process has led to a diminished workforce, compounding system defense challenges.
Xia said restructuring had left only a core team maintaining the systems. “Our security team is currently severely understaffed, but we are still doing everything we can to safeguard data and assets,”
he wrote.
Under its initial indicative restructuring proposal, BitMart is offering affected users an option between upfront asset distributions or alternative tokens tied to recovery proceedings and auxiliary exchange holdings. Management’s current indicative timeline projects that formal court filings regarding the restructuring scheme will be submitted between December 2026 and January 2027.
Why This Matters
The exploitation of platforms operating in administrative or restructuring phases illustrates the operational hazards crypto exchanges face when downsizing specialized staff. When critical engineering and security units are reduced to bare-bones teams, monitoring infrastructure across multiple layer-1 and layer-2 networks becomes increasingly difficult. Furthermore, the rapid redeployment of exploit proceeds across a single destination address between BitMart and Mercado Bitcoin highlights the sophisticated, cross-ecosystem tracking techniques employed by threat actors, reinforcing the necessity for rapid multi-network threat intelligence sharing between global crypto exchanges.
Frequently Asked Questions
Were the losses at BitMart officially confirmed by the exchange?
No. The estimated $391,000 loss across Base, Arbitrum, and Optimism was derived independently by blockchain analytics firm Bitquery based on wallet activity and proof-of-reserves data. BitMart has not officially verified ownership of the specific compromised wallets or confirmed an exact total loss.
What actions did Mercado Bitcoin take following its attack?
Mercado Bitcoin halted platform operations, secured and blocked $12.9 million of the $36.3 million in targeted assets, and confirmed that user account balances are protected and guaranteed despite the temporary platform freeze.
What is the status of BitMart’s customer compensation plan?
BitMart’s draft restructuring plan offers users an election between upfront payouts or recovery-linked tokens. The firm expects management to formally file the plan with relevant courts between December 2026 and January 2027.
