BitMart hacked mid-restructuring: $391,000 drained, revised creditor plan due in November

BitMart has been hacked a second time. On November 2, 2026, around $391,000 flowed out of wallets mostly attributed to the exchange, according to an analysis by the data service Bitquery. Founder Sheldon Xia confirmed the attack on X the following day and described the amount as small. As things stand, the incident does little to change the scale of your frozen BitMart balance, but it does change the situation: the exchange is in the middle of a restructuring, its security team is, in Xia's own words, badly understaffed, and the revised plan for creditors is due later in November.

Anyone who still has crypto or stablecoins on BitMart now effectively holds a claim against the exchange rather than a freely available balance. A claim is a right to repayment whose amount and form are only set by a formal process. That is exactly why every record relating to your account matters now. This guide sets out what is known about the hack, how the restructuring proposal of September 30 is structured, which dates lie ahead before a court gets involved and how to document your claim properly. How BitMart switched from winding down to restructuring in August is covered in our piece on the BitMart restructuring and the August 26 deadline.

BitMart hack of November 2: $391,000 drained via Base, Arbitrum and Optimism

Based on the information available so far, the outflows were spread across three layer-2 networks built on Ethereum: Base, Arbitrum and Optimism. A layer-2 network is a separate blockchain layer that bundles transactions and settles them against the Ethereum mainnet. Many exchanges keep their own wallets there to handle deposits and withdrawals cheaply.

The figure of around $391,000 does not come from BitMart itself. The exchange has not yet published its own damage estimate, nor explained how the attackers gained access to the wallets. According to the reports, BitMart has also not confirmed that every address named in the analysis actually belongs to the exchange. Xia wrote, as reported consistently by The Cryptonomist and Coincentral, that the exchange had also been hacked the day before, had investigated immediately and had tightened security. It remains unclear whether customer funds or personal data were affected.

How large is the loss relative to the shortfall?

Set against the $319.5 million shortfall that BitMart itself traces back to the 2021 hack, the roughly $391,000 amounts to about 0.12 percent. Mathematically, the new incident therefore plays a small role in the eventual recovery rate. The point made in the trade press still holds: every dollar lost now is missing at the end from the pool used to pay creditors.

Trail to Mercado Bitcoin: why the on-chain attribution is still provisional

On the same day, a far larger attack hit the Brazilian exchange Mercado Bitcoin. Estimates diverge: Mercado Bitcoin itself cites around $38 million in affected assets, the analytics firm Chainalysis puts it at about $49 million, and other reports mention $36 million. The background to that incident is in our article on the withdrawal freeze at Mercado Bitcoin.

Bitquery traced the BitMart outflows to addresses that also received funds in the Mercado Bitcoin attack. According to its analysis, the BitMart outflows began about 53 minutes before the larger attack. On-chain analysis is the study of publicly visible blockchain transactions to link flows of money to addresses and actors. Such analysis provides indications, not proof: a shared receiving address does not necessarily show that the same group was behind both incidents. Xia speaks of preliminary findings. There has been no formal attribution by investigators so far.

Understaffed security team: Sheldon Xia names the gap himself

What stands out in the statement is less the amount than the explanation. According to the reports, Xia wrote that the security team is currently severely understaffed, but that the company is doing everything it can to protect data and assets. After the switch to restructuring, BitMart kept only a core team. Departures, threats from users and disputes with former employees had made it hard to retain technical staff. Some key people stayed only after one-to-one talks.

This matters for customers because it comes from inside the company. BitMart still holds assets that thousands of users are waiting to have repaid. An exchange in wind-down or restructuring mode has less revenue and fewer staff, yet the same attack surface as before. That says nothing about future incidents. It does explain why many investors, after cases like this, ask themselves how much of their holdings should sit on an exchange at all. If you hold crypto for the long term, you can keep it in your own wallet; our comparison of hardware wallets shows which devices are suitable.

BitMart restructuring since July: from trading halt to the September 30 proposal

The background in brief: on July 26, 2026, after nine years in operation, BitMart announced the gradual closure of its trading platform. New registrations, deposits and new orders were stopped immediately, and trading ended on August 26. According to the reports, final closure is scheduled for January 31, 2027. At the time, the exchange cited operating conditions, the market environment and its future strategic direction as reasons; there was no mention yet of a shortfall.

On August 21, BitMart floated a restructuring as an alternative to a full wind-down and hired the law firm White & Case as legal adviser. On September 9, the consultancy Alvarez & Marsal followed as financial adviser. It is tasked with assessing assets, liabilities and possible ways forward. At the same time, BitMart announced a dedicated web portal through which users can give feedback on the plan. On September 30, the exchange then publicly admitted a shortfall in its holdings and presented a preliminary settlement proposal.

A $319.5 million shortfall: the 2021 hack as the cause

By its own account, most of the gap goes back to the attack of December 2021. At the time, BitMart lost assets worth $319.5 million according to the company, calculated at prices of December 4, 2021. Of that, $164.1 million was in Ethereum, $96.5 million in BNB, $51.5 million in Bitcoin and $7.4 million in other assets. Earlier estimates from 2021 put losses between $150 million and $196 million; the difference is partly explained by different valuation dates.

The exchange kept operating after the incident and funded itself through fees. In 2026, according to BitMart, the situation deteriorated: revenue from trading fees and listings fell, and the futures business made losses, partly because of trader groups exploiting rebate programmes. From May, withdrawals picked up as well. BitMart considered an offer from an investor of $10 million in liquidity too small to close the gap.

Three options in the restructuring plan: liquid assets, Restitution Token and Continuum Token

The September 30 proposal is explicitly preliminary and needs court approval. According to the summary by ForkLog, which draws on the exchange's announcement, creditors are to choose between three routes:

1. Share of the liquid assets: a pro-rata payout from whatever BitMart holds in easily realisable assets. These include fiat money, the stablecoins USDC, PYUSD and USDT, as well as Bitcoin, Ethereum and Solana. The size of the payout ratio is still open.
2. Restitution Token: a token whose value is tied to funds BitMart may recover from the 2021 hack. According to the exchange, a private investigation recently identified assets linked to that attack.
3. Continuum Token: a token tradable on a decentralised exchange, whose value is meant to depend on BitMart's holdings, the sale of illiquid assets and, if the exchange resumes business, a share of future profits.

The basic trade-off in plans like this is almost always the same: an earlier but smaller payment against a later but uncertain recovery. The first option is the most tangible, because it is paid out of existing holdings. The two token variants, by contrast, depend on future successes that nobody can put a number on today. BitMart has said it will calculate the expected recovery rate for each option for all users. Only with those figures can a real decision be made.

Valuing the claims: dollar value from July 26 and an independent assessor

One point in the proposal affects you directly, whichever option you choose later. Account balances are first to be converted into a dollar value. The basis is the weighted average price of each token from July 26 up to a cut-off date that BitMart has yet to set. An independent expert appointed by the court is to review the claims.

For holders, that means your claim will most likely be measured in dollars, not in coins. If a coin rises after the cut-off date, you no longer benefit. If it falls, nobody carries that risk in coins any more either. How long the valuation period ends up being is open and can noticeably shift the value of your claim. If you can document your balance on July 26 and at the end of trading on August 26, you will be in a stronger position if questions come up later.

Timeline to court: revision in November, filing in December or January

Under the proposal, BitMart intended to discuss the key points in October with its 50 largest customers by account balance. Based on their feedback, the plan is to be revised in November. The exchange is aiming to file for court approval in December 2026 or January 2027. Reports on the new hack cite the same timeline. BitMart has not yet said whether the incident changes it.

One detail is reported inconsistently: some trade outlets already describe the restructuring as court-supervised, while others refer to court applications that have yet to be filed. The exchange's own statements point to the latter. Until a court has approved a plan, any recovery rate mentioned is a proposal, not a commitment.

Three dates matter most for you in the coming weeks: publication of the revised plan in November, the worked examples for each option and the actual court filing. Follow announcements on these only through the exchange's official channels.

Documenting your balance: how to secure evidence for your BitMart claim

Whatever the outcome of the process, anyone who can document their claim is in a better position. It makes sense to put together a complete record now, while your account can still be accessed.

• Account balance: screenshots of the asset overview with the date visible, ideally for each coin separately.
• Exports: download your trading and transaction history as a file, if the function is still offered. A complete export is the strongest evidence.
• Withdrawal requests: record every request with date, amount, destination address and, if available, transaction ID, including rejected or pending ones.
• Correspondence: keep emails from BitMart, support ticket threads and confirmations from the feedback portal.
• Deposits: records of when and from where you deposited coins or money, for example from the history of your bank or another exchange.

Store the documents in two places, for example on your computer and in encrypted storage. An exchange that is winding down can switch off functions without much warning.

Phishing after the hack: fake recovery offers and spoofed portals

Every publicised exchange incident is followed by fraud attempts. Phishing is the attempt to obtain login details, recovery phrases or money through fake messages or websites. For BitMart customers, two scams are particularly likely: so-called recovery services that promise, for an upfront fee, to free up your balance faster, and cloned creditor portals that ask for your password and two-factor code.

A legitimate restructuring process will not charge you a fee to register a claim, nor ask for your recovery phrase. Check every link to a portal via BitMart's official channels instead of clicking links in emails or direct messages. Change your BitMart password if you use it elsewhere too, and keep two-factor authentication switched on. Anyone offering you a preferential payout is very likely a scammer.

Crypto tax after an exchange failure: the legal position in Germany is unsettled

Many of those affected ask whether a lost balance counts as a loss for tax purposes. In Germany, crypto assets held privately fall under private disposal transactions under Section 23 of the Income Tax Act. A loss from these generally requires a disposal. Whether a total loss at an exchange, a later partial settlement in dollars or the exchange of a claim for a Restitution Token counts as a disposal has not yet been expressly addressed by the tax authorities.

In practical terms: record acquisition dates and purchase prices now, while you can still access the history. Once a payment or token swap takes place, the tax treatment can be clarified with a tax adviser. Without the original data, there is nothing to base that on.

BitMart balances: until the court filing, every record counts

The second hack barely changes the numbers, but it shows how thin BitMart's staffing has become. Until the revised plan is published in November, there are three things you can do:

1. Secure your holdings: whatever you want to hold yourself in future belongs in your own wallet. The hardware wallet comparison shows which devices are suitable.
2. Review your trading venue: for new purchases, consider an exchange with a MiCA licence that is subject to supervision in the EU. The comparison of regulated crypto exchanges gives an overview.
3. Keep your history: export your BitMart transactions and prepare them for tax purposes. The programs in the crypto tax software comparison can help.

(As of November 4, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)