BitMart Exchange Hacked for $200 Million

The centralised US crypto exchange BitMart has been hit by one of the most devastating hacks to date, draining an estimated US$196 million in various cryptocurrencies.

According to a Twitter thread by Sheldon Xia, founder and CEO of BitMart, on December 5 a “large-scale breach” of its Ethereum (ETH) and Binance Smart Chain (BSC) hot wallets was discovered. The losses were estimated to be around US$200 million by security firm PeckShield, who picked it up as it was happening.

Attackers Targeting Important Private Keys

According to an official update, withdrawals have been suspended and all other wallets are secured and unharmed, as fortunately “ETH hot wallet and BSC hot wallet carry a small percentage of assets on BitMart”. Xia later announced that the breaches had been caused by a stolen private key that the attackers used to gain access to the wallets.

The hacker made away with a mix of more than 20 tokens, including altcoins such as Binance Coin (BNB), Safemoon, BSC-USD and BNBBPay (BPay), as well as sizeable amounts of memecoins such as BabyDoge, Floki and Moonshot.

After the funds were leached, they were systematically swapped for Ether (ETH) using decentralised exchange (DEX) aggregator 1inch, and thereafter deposited into privacy mixer Tornado Cash, which made the hacked funds harder to track.

In August, Hong Kong-based cryptocurrency trading platform Bilaxy also suffered a serious attack, losing an estimated US$450 million.

BitMart to Compensate Affected Users

In terms of asset deposits and withdrawals, BitMart is confident that these functions will gradually begin from December 7. The affected users at least have a silver lining after BitMart made a statement that they would be compensated and pools refunded.