InvertopediaThe encyclopedia of how things fail
Submit a failure
EntrySources
ReadSuggest an edit

BitMart

From Invertopedia, the encyclopedia of how things fail

Entry 132. An analysis built from the public record, not an insider account. Spot an error? Tell us.

BitMart was a crypto exchange that TechCrunch reported was among the top 15 exchanges in the world by volume, according to CoinGecko, and was in talks in November 2021 to raise money at a $300 million valuation[3]. On December 4, 2021, attackers drained about $196 million in more than 20 tokens from two of its hot wallets[1][2]. BitMart vowed to return users' money, but five weeks later many victims said they had received nothing[4].

This entry is a stub: the short version, sourced. Know more about BitMart? Help expand it.
Contents
  1. 1What happened
  2. 2The kill shot
  3. 3The inversion
  4. 4References

What happened

Nov 9, 2021TechCrunch reports BitMart is in talks to raise about $20 million at a $300 million valuation.[3]
Dec 4, 2021Security firm PeckShield sees steady outflows from a BitMart address to one Etherscan labels "Bitmart Hacker."[2]
Dec 6, 2021CEO Sheldon Xia says a stolen private key opened two hot wallets and BitMart later vows to return users' money.[1][4]
Jan 7, 2022CNBC reports that five weeks on, many victims say they have not been reimbursed.[4]

The kill shot

A single private key could move funds out of two hot wallets, and nothing stopped the money leaving until PeckShield noticed it.

BitMart said the hot wallets held only a "small percentage" of its assets[2]. Even so, the stolen tokens were swapped for ether on 1inch and sent into Tornado Cash, to hide the hackers' identities[1][2].

The inversion

Keep only what a day's withdrawals need in hot wallets, split signing authority so one key cannot move them, and put a withdrawal cap and an alert on every wallet.

References

  1. ^ “BitMart CEO Says Stolen Private Key Behind $196M Hack”. CoinDesk, December 6, 2021. The stolen key, two hot wallets, the $100M and $96M split, the 1inch and Tornado Cash route, compensation pledge.
  2. ^ “BitMart to compensate victims of $196 million hack, restore trading”. CNBC, December 2021. BitMart's $150M figure, PeckShield's detection, 20+ tokens, small share of assets, swap-and-launder route.
  3. ^ “Crypto exchange Bitmart in talks to raise at $300 million valuation”. TechCrunch, November 9, 2021. Top-15 exchange by volume and the $300M valuation talks.
  4. ^ “BitMart crypto hack: Victims complain they haven't been paid”. CNBC, January 7, 2022. Five weeks later, victims still unpaid.
Categories: Crypto · Exchange · Hacked in 2021 · Cause of death: stolen key · From the public record