BitMart Founder Says Security Team Was “Severely Understaffed”

BitMart says it is dealing with a severely understaffed security operation after a new breach confirmed this week, with founder Sheldon Xia pointing to personnel retention challenges following restructuring and internal disputes. Xia also suggested the timing may be linked to a larger incident at Brazil-based exchange Mercado Bitcoin earlier this month.

Blockchain analytics firm Bitquery reported that it traced roughly $391,000 in suspicious transfers from wallets associated with BitMart across three blockchains. Bitquery further said one of the involved wallets had already appeared in connection with the more than $46 million Mercado Bitcoin hack disclosed around the same time.

Key takeaways

• BitMart founder Sheldon Xia says the exchange’s security team is “severely understaffed” following restructuring.


• Bitquery links about $391,000 in suspicious transfers to wallets associated with BitMart across three chains.


• Bitquery reports a wallet overlap with the $46 million-plus Mercado Bitcoin hack, supporting BitMart’s preliminary suspicion of a connection.


• The breach arrives as BitMart continues planning user recovery steps after announcing a wind-down of trading and later operations.

New breach raises staffing and safety concerns at BitMart

On X, Xia said the exchange continues to face “numerous attacks,” even while working to protect customer data and assets. He did not provide a specific figure for the Monday incident, but emphasized the practical difficulty of keeping specialized staff in place under heightened threat conditions.

According to Xia, threats directed at employees and alleged retaliation tied to former staff complicated efforts to retain technical personnel. He wrote that persuading key staff to remain required “considerable effort and individual conversations,” yet BitMart still lacks adequate security coverage.

While Xia characterized the amount involved in the hack as “small,” Bitquery’s on-chain analysis offered a more concrete figure: approximately $391,000 in suspicious transfers from wallets it said were mostly associated with BitMart.

Bitquery traces funds and identifies wallet overlap with Mercado Bitcoin

Bitquery’s investigation, published on Wednesday, focused on suspicious fund movements it linked to the BitMart incident. The firm said transfers occurred across three blockchains and were concentrated around wallets it associated with BitMart.

Crucially, Bitquery also reported that at least one wallet tied to these movements was implicated in the more than $46 million Mercado Bitcoin hack that occurred on Monday, Nov. 2. That overlap supports Xia’s preliminary claim that the two events could be connected, at least at the level of wallet attribution.

For traders and users, wallet-linkage analysis can matter because it helps distinguish isolated incidents from coordinated compromise patterns. Still, the evidence cited here points to connections at the fund-flow and wallet level, not to a confirmed cause or attacker identity.

BitMart’s operational uncertainty continues alongside its recovery planning

The security update lands during a long period of uncertainty for BitMart. In July, the exchange announced it would end trading on Aug. 26 and cease operations in January 2027. After the announcement, users reported delayed withdrawals and accounts being frozen, concerns that increased pressure on the exchange’s wind-down and customer recovery process.

In August, a Chinese-language BitMart X account alleged employees had gone unpaid and demanded explanations regarding customer funds. Xia dismissed those claims as fabricated, though it remained unclear who controlled the account at the time.

On Monday, BitMart also published a restructuring proposal that outlines three potential recovery options for users. The plan includes approaches such as distributing liquid assets and offering recovery-linked tokens, with the exchange indicating it would seek court approval in December or January.

Cointelegraph contacted BitMart seeking details about security staffing, the latest breach, and the restructuring, but did not receive a response by publication.

Industry-wide enforcement efforts weaken as major hacks continue

BitMart’s situation is unfolding as the broader anti-crime posture in crypto faces setbacks. Bloomberg reported on Wednesday that a crypto crime-fighting alliance formed by Tron, Tether, and TRM Labs has dissolved amid a wave of large industry hacks.

The alliance included the T3 Financial Crime Unit, which launched in September 2024 and later attracted Binance as a member. Bloomberg said the unit struggled with slow response times and poor coordination, citing people familiar with the matter. One source told Bloomberg the group had effectively disbanded in late August.

T3 had previously said it helped freeze more than $450 million in assets linked to suspected criminal activity since its 2024 launch, including actions connected to Tether. The dissolution comes as several high-profile breaches have dominated headlines, including last week’s $6.3 billion Binance breach, which Bloomberg described as the largest cryptocurrency theft on record.

For market participants, this matters because it underlines a gap between threat levels and the speed or coordination of mitigation efforts. When major incidents keep occurring, even well-publicized enforcement initiatives can lose momentum—especially if they fail to deliver timely, operational results.

Next, BitMart users and observers will be watching whether the exchange can stabilize its security posture while carrying out its planned recovery routes under court oversight. Equally important will be whether additional on-chain analysis clarifies the nature of the breach and how closely it mirrors the wallet patterns seen in the Mercado Bitcoin hack.

https://www.cryptobreaking.com/bitmart-founder-says-security-team/?utm_source=blogger%20&utm_medium=social_auto&utm_campaign=BitMart%20Founder%20Says%20Security%20Team%20Was%20“Severely%20Understaffed”%20