BitMart hack — December 2021

BitMart's hot wallets on Ethereum and BNB Chain were emptied on 4 December 2021. The exchange suspended withdrawals while it investigated. Founder and chief executive Sheldon Xia said the incident was 'a large-scale security breach related to one of our ETH hot wallets and one of our BSC hot wallets' and that it was 'mainly caused by a stolen private key that had two of our hot wallets compromised'. He never disclosed how the keys were obtained; compromise of an employee account was the working theory reported at the time.

The amount is contested and has never been reconciled. BitMart's own figure was about $150 million. The blockchain security firm PeckShield, which flagged the outflows before BitMart confirmed them, put the loss higher, at roughly $192 million in its first estimate and about $196 million subsequently, split as approximately $100 million in Ethereum-based assets and approximately $96 million on BNB Chain. BitMart did not publish an asset-by-asset accounting, so the gap between the two numbers remains open. Some coverage rounded PeckShield's figure to $200 million.

The attackers routed the stolen tokens through the decentralised exchange aggregator 1inch, converted them to ether and deposited the proceeds into Tornado Cash. No suspect has been publicly identified and no law enforcement action tied to the breach has been announced.

Xia said BitMart would cover the loss from its own funds and that 'no user assets will be harmed'. The exchange said it would restore deposits and withdrawals gradually from 7 December 2021.