BitMart founder says security team is “severely understaffed” after new hack

BitMart founder Sheldon Xia says the exchange is operating with a severely understaffed security team after restructuring, just as the company confirmed a new hack that may be tied to the recent breach at Mercado Bitcoin. For high-risk operators, the useful part is not the drama on X; it is the combination of weakened internal controls, uncertain staffing, and active wallet movement across chains.

1. In a post on X on Wednesday, Xia said threats against employees and alleged retaliation by former staff had made it harder to keep technical people in place. “It took considerable effort and individual conversations to persuade some key technical staff to remain and maintain our core systems,” he wrote. “However, we continue to face numerous attacks. Our security team is currently severely understaffed, but we are still doing everything we can to safeguard data and assets.”
2. Xia described the amount involved in Monday’s hack as small, but did not disclose a figure. Bitquery, a blockchain analytics firm, identified approximately $391,000 in suspicious transfers from wallets mostly associated with BitMart across three blockchains in a Wednesday investigation.
3. Bitquery said the funds were traced to a wallet also implicated in the more than $46 million Mercado Bitcoin hack on Monday, Nov. 2, which supports Xia’s preliminary suspicion that the two incidents may be connected. BitMart has not publicly laid out the technical link beyond that preliminary view.
4. The breach lands while BitMart is already in the middle of a restructuring process. The exchange said in July that it would end trading on Aug. 26 and cease operations in January 2027. After that announcement, users reported delayed withdrawals and frozen accounts, which is the sort of background noise that tends to turn a “minor” hack into a much bigger operational problem.
5. In August, BitMart’s Chinese-language X account alleged that employees had gone unpaid and demanded answers about customer funds. Xia rejected those claims as fabricated, although the source of the account was unclear at the time. On Monday, BitMart’s restructuring proposal laid out three possible recovery paths for users, including liquid asset distributions and recovery-linked tokens, with court approval targeted for December or January.

Separately, Bloomberg reported on Wednesday that the T3 Financial Crime Unit — the crypto crime-fighting alliance formed by Tron, Tether and TRM Labs, and later joined by Binance — has dissolved amid a wave of major industry hacks. Bloomberg said the group, launched in September 2024, struggled with slow responses and poor coordination, and that one source said it disbanded in late August. In May, T3 said it had helped freeze more than $450 million in assets linked to suspected criminal activity since its launch in 2024.