Sheldon Xia, BitMart CEO, admits that the hack resulted from stolen private keys. Xia said stolen funds came from two compromised hot wallets but they wanted to be reassured that all other operations are safe and unharmed. Hot wallets refer to cryptocurrencies that are accessible online. Cold wallets are not connected to the internet and are considered more secure due to lack of online access.
Hot wallets are used as a liquidity source to facilitate user withdrawal requests, with exchanges using a mixture of both types to cater to different parts of their operations.
The incident again highlights the dangers of leaving funds on an exchange, even though Xia said BitMart will compensate user losses.
An official BitMart statement said the large scale security breach affected their ETH and BSC hot wallets, with hackers able to withdraw approximately $150 million in funds. Peckshield, the data analytics firm, estimates losses are likely to be closer to $200 million.
Around $100 million has been drained from the ETH wallet and approx. 96 million came from the BSC wallet, according to Peckshield's analysis of the affected wallets.
Stolen funds were sent to dexes, including 1 inch, and exchanged for ether. The hackers sent the swapped funds to tumblers to mix or launder the token, making the trail harder to follow.
The exchange said they are conducting a thorough security review, with updates as more is known, despite the discrepancy in numbers. They say that withdrawals are temporarily suspended and ask for patience during this challenging period.
The deadline for return of normal service is given by Xia.
Xia said that his team is working on restoring normal operations in addition to BitMart's ongoing security investigation. He called for patience again during this time.
As a soft deadline for return of normal deposit and withdrawal services, Xia gave December 7 as a deadline with updates on this based on how the situation is progressing.