-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0308
============================================================

Advisory-ID:  0xCERT-2026-0308
Severity:     Medium
Published:    2026-11-03T16:09:24.000Z
Updated:      2026-11-04T20:43:48.387Z
Chains:       Base, Arbitrum, Optimism
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0308

Title: BitMart confirms hack: about $391k drained from BitMart-linked wallets on Base, Arbitrum and Optimism

Summary
- -------
BitMart founder Sheldon Xia confirmed a small hack on 2 Nov 2026. Bitquery traced about $391k from BitMart-linked wallets on Base, Arbitrum and Optimism to the Mercado Bitcoin attacker address. Screen the attacker address listed below.

Details
- -------
Summary
BitMart founder Sheldon Xia confirmed on X on 3 November 2026 that the exchange "got hacked yesterday too", describing the amount as small and saying BitMart acted quickly to investigate and strengthen security. Bitquery reports that the same attacker behind the Mercado Bitcoin drain took about $391k from wallets tied to BitMart on Base, Arbitrum and Optimism, starting 53 minutes before the Mercado Bitcoin outflows and returning about 19 hours later. BitMart is in court-supervised restructuring after winding down trading in 2026.

Affected
- - BitMart (centralized exchange) wallets on Base, Arbitrum and Optimism, per Bitquery's address labels. BitMart has not confirmed that these wallets are its own.
- - No fix applicable; BitMart says it has strengthened security.

Impact
Bitquery estimates about $391k left BitMart-linked wallets and went to the Mercado Bitcoin hacker's main address, which is the same on every EVM chain. Bitquery says Circle froze 66,283 USDC on Base at a second hacker address funded from the BitMart-linked Base wallet. The loss figure is Bitquery's estimate, not one confirmed by BitMart. The initial access method has not been disclosed, and BitMart has not said whether user balances were affected. Bitquery cautions that the link to Mercado Bitcoin rests on on-chain behaviour and address labels.

Recommended actions
- - Exchanges, bridges, OTC desks and stablecoin issuers: screen and flag deposits from the attacker address listed in the indicators, on all EVM chains.
- - BitMart users: follow only official BitMart and restructuring-administrator channels, and beware of phishing that exploits the incident.

Source & attribution
This 0xCERT advisory summarises a statement by BitMart founder Sheldon Xia (https://x.com/sheldonbitmart/status/2117650361154691529) and on-chain analysis by Bitquery (https://bitquery.io/investigations/mercado-bitcoin-hack, https://x.com/Bitquery_io/status/2117668767832678439). The indicator is copied verbatim from Bitquery's report. Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/sheldonbitmart/status/2117650361154691529
- - https://bitquery.io/investigations/mercado-bitcoin-hack
- - https://x.com/Bitquery_io/status/2117668767832678439
- - https://www.0xcert.com/advisory/0xCERT-2026-0303

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrtDycJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdamsOuoQedoXAakIm5DHHgJVBkh2V2PyF1lqXw
rt8RIRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAB+4wD+MZSuADkMvgRkMLHQ
edvBYRUQF6u7cO1Tj1kLZZAKFbUA/0dVG4URFgwr+AFun5kFVbLQ9xJaSktI
qmErFah/AUYN
=ZjvH
-----END PGP SIGNATURE-----