Bitmart Hot Wallet Drain

On December 4, 2021, the cryptocurrency exchange Bitmart detected unauthorised activity in two of its hot wallets. By the time the wallets were drained, $196 million had moved — roughly $100M from Ethereum and $96M from BNB Chain — in a single coordinated sweep across more than 20 different tokens.

What happened

Bitmart CEO Sheldon Xia later confirmed publicly that the breach was caused by a stolen private key controlling both affected hot wallets. The compromise vector — whether endpoint malware, insider access, or supply-chain — was not publicly disclosed.

The attacker's behaviour was textbook: a single signing authority granted access to wallets on two chains; the attacker drained both simultaneously, then routed the proceeds through the 1inch DEX aggregator to swap dozens of long-tail tokens into ETH, before sending the consolidated proceeds to Tornado Cash for mixing.

Affected tokens included BNB, SafeMoon, Shiba Inu and many other ERC-20s and BEP-20s — at the time worth nearly $100M each on the two affected chains.

Aftermath

• Bitmart paused withdrawals the same day and used corporate reserves to reimburse affected customers.
• Withdrawals were restored over the following week as Bitmart rotated keys and audited wallet infrastructure.
• The stolen funds were laundered through Tornado Cash; no public recoveries.

Why it matters

Bitmart is one of the cleanest examples of a problem that recurred at half a dozen mid-tier exchanges through 2024-2025 (BingX, Phemex, Indodax, BtcTurk): a single hot-wallet key with cross-chain signing authority is a single point of catastrophic failure. Per-chain key segregation and withdrawal-velocity circuit breakers are now table stakes — but they weren't in 2021, and the lesson cost $196M to learn the first time.