Cyber Incident Victim: BitMart
Date:
Dec 2021
Location:
China
Summary
A cryptocurrency exchange suffered a $150 million security breach, marking the second-largest crypto theft of the year and the third such incident that week. Attackers compromised two hot wallets—one Ethereum-based and one Binance Smart Chain-based—by accessing their private keys, potentially through an employee account compromise. The platform's founder confirmed the theft and pledged to reimburse affected users using company funds, ensuring no customer asset losses. Withdrawals remained temporarily suspended during the investigation, which was nearing completion. The exchange, ranked #113 by trading volume at the time, emphasized ongoing security reviews following the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 4, 2021, cryptocurrency exchange BitMart announced a security breach resulting in the theft of approximately $150 million in digital assets. The incident, described as the second-largest crypto heist of the year and the third exchange hack that week, targeted two specific wallets: one Ethereum (ETH) hot wallet and one Binance Smart Chain (BSC) hot wallet. BitMart founder and CEO Sheldon Xia confirmed the breach via Twitter, explaining that hot wallets contained a small portion of exchange funds to facilitate transaction liquidity. The attack occurred on Saturday morning, prompting immediate public disclosure through company statements and Xia's social media communications. By Monday, December 6, preliminary findings indicated attackers had compromised the private keys controlling both wallets, though the exact method of key extraction remained undetermined at the time of reporting. Investigators suspected unauthorized access through an employee account compromise as the most likely attack vector.
BitMart froze all customer withdrawals following the breach while its security team conducted an investigation projected to conclude by December 7. Xia publicly committed to covering all financial losses from company reserves, assuring users their personal assets would remain unaffected. The platform maintained this withdrawal suspension throughout the investigation period to prevent further unauthorized transactions. At the time of the incident, BitMart held the #113 ranking on CoinMarketCap's exchange listings based on trading volume. The breach's operational impact centered exclusively on the two compromised hot wallets, with no evidence suggesting broader system infiltration or additional wallet compromises beyond those disclosed. The company's response prioritized securing remaining assets, determining attack methodologies, and restoring normal operations following forensic review.