BitMart founder Sheldon says there has been another security incident and the team is understaffed
BitMart founder Sheldon Xia confirmed on X that the exchange was hit by another security incident on November 2. He said the amount involved was small, and that the issue was quickly investigated and security measures were strengthened.
Sheldon said that after the restructuring, only the core team remained. Doxxing and threats against users, as well as retaliation from some departed employees, including former marketing operations head Elly, made technical staff unwilling to continue maintaining the system. The security team is currently severely understaffed, but is still trying to safeguard data and assets.
He said that the preliminary investigation showed the attack may be related to the group behind the attack on Mercado Bitcoin in Brazil on the same day. Blockchain analytics company Bitquery tracked about $391,000 flowing out of wallets mainly associated with BitMart to addresses linked to the Mercado Bitcoin attack. The platform had previously been offline for several months, and user assets had long been unable to be withdrawn.
Original source:
Title: Yes, we got hacked yesterday too. The amount involved was small...
Posted by: Sheldon (@sheldonbitmart)
Publication date: 2026-11-03
URL: https://x.com/sheldonbitmart
Nature of source: Personal public post
Verification status: The content of the original post quoted in the report was read; the amount and staffing situation are the speaker's own account
Supporting content: Confirmation of the security incident, the small amount involved, the core team, doxxing threats and Elly, the security team's understaffing, and a possible link to Mercado Bitcoin
ABAB AI Insight
Sheldon framed the incident as an attack involving a small amount and one that has already been handled. He also explained that after the restructuring only core personnel remained, and that user threats and retaliation from former employees affected technical staff’s willingness to stay.
The understaffing of the security team was presented as background to the repeated attacks the company is facing. The preliminary investigation put the incident in relation to the attack on Mercado Bitcoin on the same day, but no formal attribution was completed.
From an operational perspective, the platform is in a phase of restructuring and shutdown, and withdrawals have been restricted for a long time. The new security incident occurred after staffing had been reduced, increasing attention on the ability to protect the remaining assets.
Structurally, this is a public statement that places confirmation of the security incident, the reasons for the staffing shortage, and a possible external attack link side by side. It does not provide detailed disclosure of the full asset situation or the impact on user balances.
ABAB News · Law of Cognition
The security incident is described as involving a small amount and having already been investigated and security measures strengthened.
After the restructuring, only the core team remained; doxxing and retaliation by former employees were cited as reasons technical staff were unwilling to stay.
The preliminary investigation linked the incident to the attack on Mercado Bitcoin on the same day.