BitMart

On December 4, 2021, BitMart suffered one of the largest exchange hacks of that year when attackers exploited a stolen private key to drain two hot wallets — one on Ethereum and one on BNB Smart Chain — stealing approximately $196 million in user funds. CEO Sheldon Xia publicly acknowledged the breach within hours and committed to compensating all affected users with corporate funds. By January 2022, BitMart announced it had completed reimbursements to impacted accounts. The incident prompted a comprehensive security overhaul including expanded cold storage and stricter wallet controls.

Following the 2021 hack, BitMart restructured its security architecture. The exchange now claims to store over 98% of user funds in cold wallets — offline storage not exposed to internet-facing systems — with only a minimal portion in hot wallets for liquidity. Additional measures include multi-signature authorization for wallet transactions, enhanced real-time monitoring, stricter withdrawal verification protocols, and a bug bounty program to identify vulnerabilities. The depositing wallets across multiple blockchains were also replaced post-incident.

As of 2024–2025, BitMart does not publish a formal, cryptographically verifiable Proof of Reserves. The exchange has shared some hot wallet addresses for Bitcoin, Ethereum, and BNB, but these cover only a small fraction of total holdings and do not constitute the independent, auditable verification standard that top-tier exchanges provide. Until a full Merkle tree PoR system is live and audited, users cannot independently verify that BitMart holds customer funds 1:1.

BitMart is registered as a Money Services Business (MSB) with FinCEN in the United States, which permits crypto-to-crypto activity in most US states. However, it is not comprehensively licensed in the EU or most other major jurisdictions. BitMart was added to the Ontario Securities Commission's investor caution list in 2021 for operating without proper registration in Canada. Users in regulated markets should verify whether BitMart is permitted to operate in their jurisdiction before using the platform.

Yes, BitMart requires Know Your Customer (KYC) identity verification for full account access, including higher withdrawal limits and access to all trading features. The exchange supports two-factor authentication (2FA) via authenticator app, which is strongly recommended. Given BitMart's history as a hack target, enabling 2FA and using a strong unique password are considered baseline security hygiene for any account on the platform. Users should also avoid keeping large crypto balances on any custodial exchange and withdraw to personal wallets where possible.