Cryptocurrency exchange BitMart has suffered a security breach involving a relatively small amount of funds, with founder Sheldon Xia suggesting the incident may be connected to the recent attack on Brazilian exchange Mercado Bitcoin.
Xia confirmed the breach on November 4, 2026, saying the company had launched an investigation and strengthened its security measures. The announcement follows the November 2 Mercado Bitcoin attack, which blockchain investigators estimate involved between $46 million and $49 million in stolen cryptocurrency.
Preliminary findings suggest that the same attacker-controlled addresses may have received funds associated with both exchanges. However, neither the identity of the attackers nor the precise method used to compromise the platforms has been independently established.
BitMart has not disclosed a definitive loss figure or confirmed that customer balances were affected. The incident comes as the exchange undergoes restructuring and liquidation proceedings, adding another operational challenge during a period of heightened cybersecurity concerns.
Blockchain Investigators Identify Possible Connection Between Attacks
Blockchain analytics company Bitquery identified suspicious transfers originating from wallets outside Mercado Bitcoin before the Brazilian exchange experienced its principal losses. According to its investigation, approximately $298,000 was transferred from unrelated wallets across Base, Arbitrum and Optimism before the Mercado Bitcoin attack.
One Arbitrum wallet was labeled as belonging to BitMart. The transfers began approximately 53 minutes before the first major Mercado Bitcoin outflows, with funds reaching an address subsequently associated with the Brazilian exchange exploit.
Bitquery cautioned that blockchain address labels do not independently establish ownership or confirm how a wallet was compromised. Separate reporting cited approximately $391,000 in suspicious outflows associated primarily with BitMart-linked wallets.
The difference between those estimates reflects variations in the transactions and addresses included in each assessment. Xia’s subsequent acknowledgment strengthens the evidence that BitMart experienced a security incident, but does not conclusively establish that the same individuals conducted both attacks.
Investigators have also not confirmed whether the exchanges shared a compromised infrastructure provider, wallet management service or other operational dependency. Such connections remain possibilities rather than established findings.
Mercado Bitcoin Losses Highlight Broader Exchange Security Risks
Mercado Bitcoin confirmed a security incident on November 2 and temporarily suspended deposits and withdrawals while investigating unauthorized transactions. Blockchain analytics firm Arkham initially identified more than $46 million in stolen assets across multiple networks.
Bitquery subsequently estimated approximately $48.5 million in losses across ten blockchains, while Chainalysis reported roughly $49 million across a wider set of networks. The varying figures reflect differences in asset valuations, transaction coverage and blockchain attribution.
Mercado Bitcoin said it would cover customer losses and reported that approximately $11 million in affected assets had been frozen with assistance from industry partners. Chainalysis separately confirmed coordinating efforts that restricted nearly $10 million in stolen cryptocurrency.
The Brazilian exchange also stated that customer information had not been compromised. The incidents follow several other cryptocurrency security breaches, including the October 29 Binance attack involving approximately $6.3 billion in affected assets.
However, investigators have not established a connection between the Binance incident and the attacks involving Mercado Bitcoin and BitMart. For cryptocurrency exchanges, the events underscore the importance of safeguarding operational credentials, monitoring suspicious withdrawals and coordinating quickly with blockchain investigators.
BitMart’s next disclosures will be important in establishing the financial impact of its breach and whether customer assets require remediation.
For now, the suspected connection remains based on preliminary investigative findings rather than a completed forensic attribution.