BitMart Exchange Hacked for $200 Million

The centralised US crypto exchange BitMart has been hit by one of the most devastating hacks to date, draining an estimated US$196 million in various cryptocurrencies.

1/3 We have identified a large-scale security breach related to one of our ETH hot wallets and one of our BSC hot wallets. At this moment we are still concluding the possible methods used. The hackers were able to withdraw assets of the value of approximately USD 150 millions.

— Sheldon (@sheldonbitmart) December 5, 2021

According to a Twitter thread by Sheldon Xia, founder and CEO of BitMart, on December 5 a “large-scale breach” of its Ethereum (ETH) and Binance Smart Chain (BSC) hot wallets was discovered. The losses were estimated to be around US$200 million by security firm PeckShield, who picked it up as it was happening.

Total estimated loss: ~200M (~100M on @ethereum and ~96M on @BinanceChain ). (Previously we only counted the loss on @ethereum). And here is the list of affected assets/amounts on @BinanceChain pic.twitter.com/cXXApDFtd7

— PeckShield Inc. (@peckshield) December 5, 2021

Attackers Targeting Important Private Keys

According to an official update, withdrawals have been suspended and all other wallets are secured and unharmed, as fortunately “ETH hot wallet and BSC hot wallet carry a small percentage of assets on BitMart”. Xia later announced that the breaches had been caused by a stolen private key that the attackers used to gain access to the wallets.

1/4 In response to this incident, BitMart has completed initial security checks and identified affected assets. This security breach was mainly caused by a stolen private key that had two of our hot wallets compromised. Other assets with BitMart are safe and unharmed.

— Sheldon (@sheldonbitmart) December 6, 2021

The hacker made away with a mix of more than 20 tokens, including altcoins such as Binance Coin (BNB), Safemoon, BSC-USD and BNBBPay (BPay), as well as sizeable amounts of memecoins such as BabyDoge, Floki and Moonshot.

After the funds were leached, they were systematically swapped for Ether (ETH) using decentralised exchange (DEX) aggregator 1inch, and thereafter deposited into privacy mixer Tornado Cash, which made the hacked funds harder to track.

Pretty straightforward: transfer-out, swap, and wash @sheldonbitmart pic.twitter.com/LyA03sbgCZ

— PeckShield Inc. (@peckshield) December 5, 2021

In August, Hong Kong-based cryptocurrency trading platform Bilaxy also suffered a serious attack, losing an estimated US$450 million.

BitMart to Compensate Affected Users

In terms of asset deposits and withdrawals, BitMart is confident that these functions will gradually begin from December 7. The affected users at least have a silver lining after BitMart made a statement that they would be compensated and pools refunded.

2/4 BitMart will use our own funding to cover the incident and compensate affected users. We are also talking to multiple project teams to confirm the most reasonable solutions such as token swaps. No user assets will be harmed.

— Sheldon (@sheldonbitmart) December 6, 2021