Two Hot Wallets, $196 Million Gone: Inside the BitMart Breach

BitMart, which brands itself the "Most Trusted Crypto Trading Platform," lost approximately $196 million from two hot wallets — one on Ethereum, one on BNB Smart Chain (BSC) — in an attack spanning the night of December 4 into December 5, 2021. The stolen assets, mostly memecoins, broke down to roughly $100 million on Ethereum and roughly $96 million on BSC.

Word of the breach first spread via a PeckShield tweet. BitMart's own Telegram administrators initially dismissed the reports as "fake news," telling users that inquiries about a possible hack were creating "unnecessary tension."

That position didn't last. BitMart CEO Sheldon Xia soon confirmed that a "security breach" had occurred, stating: "At this moment we are temporarily suspending withdrawals until further notice." Xia's figure for the loss — $150 million — undershot the roughly $196 million already being reported, a figure BitMart's own official statement went on to use as well.

How the attack unfolded

On Ethereum, a transaction at 21:31:09 UTC pulled out roughly $33 million in SHIB. About thirty minutes later, a parallel attack began on BSC, with a transaction draining approximately $41 million in SAFEMOON.

The Ethereum wallet involved, labeled "Bitmart 2", was emptied of nearly everything of value. The one notable asset left behind was roughly $40 million of BitMart's own exchange token — likely spared only because it would have been hard to offload anywhere outside BitMart itself. On BSC, the affected wallet saw comparable treatment. Full token-by-token breakdowns of the losses are available for both Ethereum ($100M) and BSC ($96M).

The stolen funds were routed to three destination addresses: two on Ethereum — 0x39fb0dcd13945b835d47410ae0de7181d3edf270 and 0x4bb7d80282f5e0616705d7f832acfc59f89f7091 — and one on BSC, 0x25fb126b6c6b5c8ef732b86822fa0f0024e16c61. From those addresses, the attacker converted the various memecoins into ETH and BNB through 1inch, then routed the proceeds through Tornado Cash.

As of publication, BitMart had not disclosed the root cause of the breach or committed to reimbursing affected users. The exchange's security page states that under 0.5% of its assets are held in hot wallets at any given time — a disclosure that, taken at face value, would put BitMart's total holdings above $39 billion.

Context

The breach came just two days after Celsius lost $50 million from a hot wallet during the BadgerDAO front-end attack, a loss Celsius also initially downplayed. The incident pushed BitMart to the No. 2 spot on Rekt's leaderboard of crypto losses.

How the attacker gained access to both wallets was not established at the time. One plausible failure mode — an unlimited token approval left open to an externally owned account, the same mistake implicated in the Celsius case — remained unconfirmed for BitMart. Whatever the cause, the scale of the loss is notable: a Cayman Islands-registered exchange lost close to $200 million, initially denied and then downplayed the incident, and froze withdrawals while the story moved through the news cycle. Custodial platforms like BitMart ask users to give up control of their assets on the premise that the operator's security practices exceed what an individual could manage alone — an assumption this incident, following Celsius by two days, did little to support. Whether BitMart ultimately compensates affected users remained an open question at the time of writing.