Garden Finance has temporarily taken its application offline after an attacker compromised the off-chain database of an independent solver, leading to the loss of solver-owned digital assets while leaving protocol contracts and user funds unaffected.

Blockchain security firm Blockaid reported on Sunday that an attacker drained about $450,000 in USDT from Garden Finance’s hash time-locked contracts (HTLCs) deployed across Ethereum, Base, Arbitrum and BNB Smart Chain, describing the exploit as active while publishing wallet addresses linked to the attacker and the affected contracts.

Garden Finance later told Cointelegraph that the protocol itself had not been breached. Instead, the company said the incident originated from the off-chain infrastructure of an independent solver, where an attacker gained access to the solver’s database and inserted fraudulent transaction records that triggered releases of funds for swaps that had never been funded by the corresponding counterparty.

As a precaution, Garden temporarily took its application offline while engineers isolated the affected infrastructure and reviewed the incident. The protocol said no user funds were lost or exposed because only assets owned by the affected solver were involved.

The company added that it is still verifying the total amount lost, along with the exact assets and blockchain networks affected by the attack.

Off-chain solver targeted rather than protocol

While Blockaid initially associated the incident with Garden’s HTLC infrastructure, the protocol said its smart contracts continued operating as designed and were not exploited.

Garden explained that HTLCs serve as escrow contracts that enable atomic swaps between Bitcoin and assets on other blockchains by locking funds until predefined conditions are met or time limits expire. According to the company, those contracts remained secure throughout the incident.

Instead, Garden attributed the loss to manipulated records inside the compromised off-chain database used by one of its independent solvers. The fraudulent entries caused the solver to release funds for swaps despite the corresponding deposits never being completed.

According to Garden, the incident remained isolated to a single participant within its decentralized network of independent solvers rather than affecting the broader protocol.

“Garden’s protocol and HTLC smart contracts were not compromised, and no user funds were lost or at risk,” the company told Cointelegraph while emphasizing that only solver-owned assets were affected.

The protocol also noted that it does not control the infrastructure operated by independent solvers, which execute swaps within the network.

Recovery efforts underway with security firms

Garden said it has engaged blockchain security and incident response firms zeroShadow, Quantstamp and Blockaid to trace the stolen assets and support recovery efforts.

Alongside those investigations, the company said it expects to restore normal services after completing additional security reviews, although it has not provided a timeline for bringing the application fully back online.

The protocol added that its immediate priorities include securing the affected infrastructure, tracing the compromised solver’s assets and ensuring every required security check has been completed before services resume.

Garden also pointed to its recently completed SOC 2 Type II attestation, saying the certification demonstrates ongoing investment in operational controls and security processes even though the latest incident originated from infrastructure operated by an independent network participant.

The latest disclosure comes only days after Singapore-based stablecoin payments company Triple-A confirmed unauthorized access to company treasury wallets that resulted in the loss of corporate digital assets while customer funds remained unaffected.

According to Triple-A, the July 25 incident impacted only company-owned treasury assets because customer funds are held separately in safeguarded trust accounts rather than inside company wallets. The company temporarily placed certain services into maintenance mode before restoring normal payment operations after additional security checks.

Triple-A also said it is working with blockchain forensics specialists, cybersecurity experts and the Singapore Police Force to investigate the breach and trace the stolen assets. Although blockchain investigators estimated losses eventually reached about $11.8 million, the company has not confirmed the total amount or disclosed how the unauthorized access occurred.

Garden’s latest disclosure also follows an earlier security incident involving one of its independent solvers.

According to the protocol, an attacker compromised the operating environment of another solver in October 2025 and stole approximately $11.4 million. Garden said that the attack likewise did not affect its protocol contracts or place user funds at risk because the compromise remained limited to the solver’s operating environment rather than the protocol itself.

The latest attack adds to a series of security incidents reported across the cryptocurrency sector during 2026.

Last week, decentralized finance protocol Lien Finance disclosed the loss of approximately 542,144.63 USDC after attackers exploited weaknesses in its bond validation and pricing logic. Blockchain security firm SlowMist said the flaw allowed unsupported bond tokens to be minted and exchanged for real USDC liquidity without consuming the required collateral.

Garden Finance is investigating an exploit that reportedly involved its cross-chain bridge and atomic swap infrastructure after an attacker drained roughly $450,000 worth of USDT from Garden-linked hash time-locked contracts (HTLCs) across multiple networks, according to Blockaid. The incident has also triggered a temporary pause in Garden’s services while the affected systems are isolated and reviewed.

Garden’s position differs from the initial description of the breach: the company says its protocol and on-chain HTLC smart contracts were not compromised. Instead, Garden attributes the event to an intrusion into the off-chain database of an independent solver, where fraudulent transaction records were allegedly inserted—leading to incorrect swap releases.

Key takeaways

• Blockaid reported an attacker drained about $450,000 in USDT from Garden HTLCs on Ethereum, Base, Arbitrum, and BNB Smart Chain.
• Garden says the protocol and HTLC smart contracts were not altered or hacked; the compromise was limited to an off-chain database belonging to one independent solver.
• Garden stated no user funds were lost or placed at risk, and that only solver-owned assets were affected.
• Services were paused as a precaution while Garden, and multiple security firms, trace and recover the funds.

What Blockaid says happened

Earlier Sunday, Blockaid said the exploit was ongoing and involved Ethereum-based HTLCs used by Garden to coordinate atomic swaps. In its public update, Blockaid described the attacker draining approximately $450,000 in USDT from Garden’s HTLCs deployed across Ethereum, Base, Arbitrum, and BNB Smart Chain.

HTLCs function as time-bound escrow contracts that help ensure assets are released only under the correct conditions—an essential mechanism for atomic swaps spanning different chains. Blockaid also published addresses it linked to the attacker and the contracts believed to be affected.

Garden’s rebuttal: off-chain solver database breach

Garden Finance disputed the implication that its core contracts were compromised. A spokesperson told Cointelegraph that neither the Garden protocol nor its HTLC smart contracts were breached.

According to Garden, the attacker accessed the off-chain database of an independent solver and inserted falsified transaction records. In Garden’s account, those incorrect records led the solver to release funds for swaps that were not actually funded by the intended counterparty.

Garden added that the incident did not place user funds at risk and that no funds belonging to users were lost. Instead, the company said the impact was confined to solver-owned assets. Garden also indicated that it is still confirming the full extent of the event—total amount, assets, and the precise networks involved.

Why an off-chain compromise can matter

While HTLCs are executed on-chain, cross-chain swap systems often rely on off-chain infrastructure to coordinate actions, track swap state, and trigger settlement steps. Garden’s explanation centers on this split: the protocol’s on-chain components were allegedly left intact, but the solver’s off-chain data was manipulated in a way that caused settlement to occur incorrectly.

For market participants, this distinction is important. If the core smart contracts remain secure, the long-term trust impact may be smaller than in a scenario involving altered HTLC logic or compromised protocol contracts. Still, the incident highlights a persistent vulnerability class for cross-chain systems: even with audited or well-designed on-chain escrow logic, operational processes and off-chain databases can become critical attack surfaces.

Garden’s immediate response—pausing services and isolating the suspected infrastructure—reflects how quickly operational compromises can cascade into on-chain fund movements. The difference between a contract-level exploit and a solver-level data breach may affect remediation timelines, too, because recovery depends not only on stopping the bleeding but also on validating swap states and ensuring incorrect releases do not recur.

Security response and previous incident

Garden said it is working with zeroShadow, Quantstamp, and Blockaid to trace and recover the funds. The protocol expects to restore services shortly, contingent on completing security checks, but it did not provide a specific timetable.

Garden also pointed to its SOC 2 Type II attestation as evidence of security and operational controls, framing the incident as isolated to one solver’s off-chain infrastructure within its network of independent solvers. The company emphasized that its priorities are securing the affected systems, tracing the solver’s funds, and resuming services only after relevant reviews are completed.

The reported event follows an earlier pattern. In October 2025, Garden reported a breach in which an attacker stole about $11.4 million after compromising the operating environment of one of its solvers. Garden said that earlier incident similarly did not compromise its protocol contracts or put user funds at risk.

Taken together, the two episodes suggest that Garden’s risk exposure may be closely tied to the security posture and isolation of third-party solver environments rather than flaws in its HTLC contract code. That shifts where investors and integrators should focus their monitoring: operational security, access controls, and off-chain data integrity across the solver ecosystem.

As Garden continues tracing the funds and validating affected swap records, the key question for users and builders will be whether the investigation confirms a consistent “solver off-chain” failure mode or reveals broader compromise indicators. Readers should watch for Garden’s updated totals, the specific networks and assets involved, and the results of the security checks that will determine when services fully resume.

Triple-A has confirmed that unauthorized access to its treasury wallets resulted in the loss of company-owned digital assets while stating that client funds and payment operations have remained unaffected.

Triple-A said in a statement on Monday that it detected unauthorized access to certain wallets holding its own digital assets on July 25, prompting the company to temporarily place some services into maintenance mode for about three hours while it secured the affected infrastructure and completed additional security checks.

The Singapore-based stablecoin payments company said all services have since been restored and that transactions and settlements are processing normally across all markets. It added that the incident affected only its treasury assets, with the financial impact limited to specific operational accounts that will be fully absorbed through the company’s treasury reserves.

Client assets were not exposed, according to Triple-A, because the company does not provide digital asset custody services on behalf of customers. Instead, it said client funds are held separately in trust accounts maintained with safeguarding institutions that were not affected by the incident.

Triple-A also said it remains well capitalized, can meet all of its liabilities, and continues to operate globally at normal service levels despite the breach.

Company confirms breach after on-chain investigators flagged suspicious activity

The announcement follows reports from blockchain investigators over the weekend that identified unusual transactions involving wallets linked to Triple-A before the company publicly acknowledged the incident.

On-chain investigator Specter initially estimated that more than $9.3 million had been removed from wallets associated with Triple-A before revising the estimate to more than $9.7 million as additional transfers were identified. The investigator later estimated the losses at about $11.8 million, although Triple-A has not disclosed the total amount of digital assets lost.

Blockchain security firm PeckShield also drew attention to the suspicious transactions after Specter’s initial findings.

Before the company released its statement, researchers had not determined whether the affected wallets contained company funds, customer assets, or payment recipient balances. Triple-A’s latest update clarified that only company-owned treasury assets were impacted and that customer funds remained segregated from the affected infrastructure.

The company has also not disclosed how the unauthorized access occurred or whether the incident resulted from compromised credentials, infrastructure weaknesses, or another attack method. As a result, the exact cause of the breach remains under investigation.

Assets reportedly moved across multiple blockchains

Earlier analysis from Specter indicated that the suspicious activity involved wallets operating on Ethereum, Solana, TRON and TON, while some reports also identified transactions on Polygon and Arbitrum.

According to the on-chain findings, the transferred assets were swapped and bridged to Ethereum after leaving the affected wallets. Researchers reported that the receiving address accumulated approximately 5,226.66 ETH, valued at roughly $9.7 million when the activity was first identified.

Neither Triple-A nor investigators have publicly identified the suspected attacker. At the time of the company’s announcement, there was also no confirmation that the assets had been transferred to a cryptocurrency exchange, a mixer or another laundering service after reaching Ethereum.

Triple-A said it is working with internal and external cybersecurity experts, blockchain forensics specialists and relevant authorities, including the Singapore Police Force, to investigate the incident, trace the affected assets and support recovery efforts.

The company did not provide a timeline for completing the investigation or indicate whether any portion of the stolen assets has been frozen or recovered.

Latest incident adds to active year for crypto security breaches

The incident comes as blockchain security researchers continue to report a steady stream of attacks targeting cryptocurrency platforms and decentralized finance protocols throughout 2026.

Last week, decentralized finance protocol Lien Finance disclosed a loss of about 542,144.63 USDC after attackers exploited flaws in its bond validation and pricing logic. Blockchain security firm SlowMist said the exploit allowed unsupported bond tokens to be created and exchanged for real USDC liquidity without consuming the required collateral.

Separate analysis from DefimonAlerts and researcher exvulsec described the attack as a protocol validation and valuation failure rather than a conventional smart contract exploit, while researchers compared parts of the incident with the earlier Drift Protocol attack because both involved weaknesses in asset valuation rather than cryptographic protections.

Researchers tracking decentralized finance attacks have estimated cumulative losses exceeding $630 million during the first seven months of 2026, identifying oracle manipulation, pricing flaws, compromised credentials and bridge validation weaknesses among the most common attack methods recorded this year.

Another major investigation also remained active this week after wallets tied to the $285 million Drift Protocol exploit resumed moving funds following roughly three months of inactivity. On-chain records showed that more than 23,095 ETH, worth about $44.4 million, was transferred into Tornado Cash, making the movement of stolen assets more difficult to trace.

Coinbase chief executive Brian Armstrong said artificial intelligence and crypto are not rival trends.

Instead, he argued that crypto will provide financial infrastructure for autonomous AI agents.

In a July 27 post on X, Armstrong said agents “will eventually transact far more per day than all humans combined.” He presented that outcome as a forecast for payments and other financial actions online.

Armstrong said AI agents cannot use traditional banking services like people or companies. They may need to pay for data, software, computing power and other agents without human approval. He said blockchains and stablecoins can provide fast, programmable and global settlement.

Armstrong frames crypto as AI’s financial layer

Armstrong’s post responded to the idea that crypto companies should abandon blockchain work and move into AI. He rejected that choice. In his view, AI supplies programmable intelligence, while crypto supplies programmable money. He called the combined model “Agentic Finance,” or “AiFi,” and said Coinbase is building products for that market.

The Coinbase chief did not give a date for agents to exceed human transaction counts or estimate payment value. His statement focused on frequency, which could rise if software pays small amounts for every API call, data request or computing task. That model differs from consumer payments, which usually involve fewer and larger purchases.

Coinbase expands its Agentic Finance products

Coinbase has already released several products aimed at autonomous software. In June, it launched Coinbase for Agents, which connects AI systems to user accounts through a command-line interface and Model Context Protocol tools. Users can set limits while agents trade crypto, monitor markets, rebalance portfolios and execute defined financial tasks.

On July 23, Coinbase expanded that service with live market data and plain-language conditional commands. It also added x402 support for Coinbase Business, allowing companies to accept USDC payments initiated by AI agents. A new developer kit lets websites and API providers add x402 payment acceptance with a small amount of code. As crypto.news reported, the rollout covers businesses, users and developers building agent services.

The exchange introduced Agentic.market in April. The marketplace lets agents find and pay for data, search, computing, inference and trading tools. Coinbase calls it a discovery layer for machine commerce because agents can locate services and buy access without a conventional subscription or manually issued API key.

x402, Base and USDC anchor Coinbase’s strategy

Armstrong said Coinbase pioneered the model through x402, Base and USDC. x402 adapts the HTTP 402 “Payment Required” response so a website or API can request payment during an internet interaction. A wallet signs the payment, a facilitator checks it, and the service delivers the requested resource after approval.

Coinbase uses USDC as the main payment asset in many x402 products, while Base provides low-cost blockchain settlement. The protocol also supports other networks and assets. Coinbase’s developer documentation lists support across Base, Solana, Polygon, Arbitrum and World, depending on the payment method and facilitator.

As crypto.news previously reported, Coinbase said AI agents already use x402 to buy data, computing resources and digital services. Related coverage also reported that Coinbase Business customers can now receive USDC directly from agents. These products turn Armstrong’s wider claim into a commercial strategy built around wallets, stablecoins, trading access and payment tools.

Forecast remains unproven as researchers flag risks

Armstrong’s claim remains a prediction. Current totals do not prove that independent AI agents have formed an economy larger than human commerce. A July paper examining x402 activity on Base found highly concentrated transaction counts. Its authors also said some payments were internal or cheap to generate, making headline totals a weak adoption measure.

Separate July research tested 15 x402 facilitators and reported rule violations across every system examined. The researchers described risks involving unpaid services, asset theft, denial of service and gas abuse. They said affected providers, including Coinbase, received the findings and adopted fixes. The papers remain preprints and have not completed peer review.

Regulators are also studying automated finance. Bank of England Deputy Governor Sarah Breeden said in June that existing rules did not account for autonomous agents. She raised the possible use of guardrails, circuit breakers and stronger recovery systems if AI-driven trading or payments create wider problems.

Coinbase continues to position crypto as the payment layer for machine activity. Armstrong’s latest post connects that strategy to a larger claim: agents may become economic actors that hold funds and transact at high frequency. Whether they overtake humans will depend on real usage, security, regulation and demand for paid machine services.

Storj Labs has filed for Chapter 11 bankruptcy protection after raising about $35 million through venture funding, grants and its 2017 STORJ token sale.

The company filed the case on July 26 in the U.S. Bankruptcy Court for the Northern District of West Virginia under case number 5:26-bk-00512.

According to Storj’s official restructuring announcement, the filing aims to address older financial obligations while allowing the decentralized cloud storage company to continue operating. Storj said customer services, its network and its main business would continue during the court process, subject to bankruptcy rules and court approval.

Storj seeks to address legacy debt

Storj described the Chapter 11 case as a restructuring rather than a shutdown. The company said it plans to continue normal operations while it works through debts linked to an earlier stage of the business. However, the announcement did not provide a full list of assets, liabilities or creditors.

Kaloyan Raev, Storj’s director of software engineering, said the business was “strong and right-sized” but remained held back by “legacy obligations from an earlier chapter.” The statement reflects the company’s position, but the bankruptcy court will still review its finances, creditor claims and any proposed reorganization plan.

Storj also said it has narrowed its focus to its core cloud business. It is disposing of earlier acquisitions and non-essential operations as part of that process. Inveniam supports the restructuring and said the company should return its attention to distributed storage, compute and file-access services.

Inveniam announced an agreement to acquire Storj in October 2025. The companies said Storj would remain a separate legal entity and operate as an Inveniam subsidiary. They also said existing customer, supplier and community relationships would remain in place.

Services expected to continue during Chapter 11

Storj said it “does not anticipate any interruptions” to customer services during the bankruptcy process. That wording expresses an expectation rather than a guarantee. The company must continue meeting its obligations under bankruptcy law, and some business decisions may require approval from the court.

The Storj network uses independent storage providers to supply unused storage capacity. Customers can access distributed cloud storage through tools designed to work with common business systems. The STORJ token supports payments across parts of the network, including compensation for node operators who provide storage and bandwidth.

The company’s official website continued to advertise cloud storage, file access and compute products after the filing. Storj has not announced changes to the token’s network role. Still, the bankruptcy concerns Storj Labs as a company, and the court process may shape its ownership, finances and business structure.

Before the filing, Storj had also adjusted parts of its cloud storage business. The company announced new storage and egress prices that took effect on July 1, 2026, while maintaining separate terms for some customers using older plans.

Token holders may join ownership proposal

Storj said management, community members, STORJ holders, current investors and possible new investors could share ownership of the reorganized company. The announcement described this as a plan, not a completed arrangement. It did not state how many token holders could qualify or how ownership would be allocated.

Any ownership proposal must appear in a formal Chapter 11 plan and receive the required creditor support and court approval. Storj has not disclosed conversion terms, eligibility rules, valuation details or a timetable. Therefore, holding STORJ does not currently give a confirmed right to shares in the reorganized business.

The proposed structure differs from the court-supervised asset-sale approach used by some other crypto companies. As crypto.news reported, Poolin entered Chapter 11 while pursuing a sale of its Texas bitcoin mining assets. The mining company reported about $173.1 million in obligations before filing.

Similarly, Movement Labs filed for Chapter 11 in July with liabilities that could reach $10 million. Meanwhile, a separate developer said work on the Movement blockchain would continue despite the original company’s bankruptcy case.

Storj raised about $35 million before filing

Storj completed a $30 million STORJ token sale in May 2017. The sale reached its target in seven days, although the company had initially scheduled it to remain open until June 19. Participants received STORJ tokens that they could use within the storage ecosystem.

The company also raised traditional funding before and around the token sale. Storj announced a$3 million seed round in February 2017 to support development of its distributed cloud storage platform. The round included investors linked to Qualcomm Ventures and Techstars.

CB Insights funding data places Storj’s total equity funding at about $5.05 million across six rounds. Combined with the token sale, the publicly reported amount reaches roughly $35 million.

Inveniam’s October 2025 acquisition announcement said Storj would retain its existing services, leadership and community relationships. It also said the STORJ token would remain part of the company’s decentralized infrastructure.

The bankruptcy filing came about nine months after that acquisition announcement. Storj has not yet released a full reorganization plan, detailed creditor schedule or final ownership terms. Future court filings should provide more information about its debts, available financing, asset sales and the proposed role for token holders.

WEMIX confirmed that an attacker took control of owner privileges linked to its WEMIX$ stablecoin contract on July 26.

The access allowed the attacker to create tokens without approval and move assets through several blockchain networks. An early Korean report valued the abnormal issuance and transfers at about $6.25 million. A later WEMIX update gave a more detailed figure of roughly 5.23 million WEMIX$ minted.

The company said the incident began at about 9:17 UTC, or 6:17 p.m. in South Korea. WEMIX identified suspected attacker wallets and asked exchanges and stablecoin issuers to help freeze the assets. It also started tracing the transactions with blockchain security companies. The cause of the owner-privilege compromise remains under investigation, and WEMIX warned that its initial figures may change.

Attacker converts minted WEMIX$ into other assets

According to WEMIX’s official incident update, the attacker issued about 5,225,525 WEMIX$ without permission. The attacker then converted the tokens into 30,736 WEMIX and 724,198.27 USDC.e. This official breakdown differs from the first $6.25 million estimate, which covered the wider abnormal issuance and movement reported on-chain.

The attacker bridged USDC.e to Ethereum and BNB Smart Chain before swapping parts of the funds into assets including ETH and USDT. Some assets also reached centralised exchanges. WEMIX said several exchanges had frozen linked addresses after receiving requests for help. However, the company has not named those exchanges or stated how much money remains frozen, recoverable or under attacker control.

The company has not said whether ordinary user balances were directly affected. It also has not published a full list of compromised contracts, transaction hashes or recovery amounts. Those details matter because the nominal value of tokens created does not equal the amount successfully converted and removed. WEMIX said its review now continues across several networks.

WEMIX suspends bridges and affected services

WEMIX temporarily stopped all bridges connected to the WEMIX3.0 network. The suspension covered Chainlink CCIP and the PLAY Bridge. The company also paused trading in affected liquidity pools, removed foundation-provided liquidity and stopped the WEMIX$ Module and PNIX decentralised exchange. These steps aimed to block additional transfers while the team reviewed contract permissions and related systems.

In its first notice, WEMIX said it had confirmed abnormal transactions and was “currently analysing the cause of the incident and taking emergency measures.” The company said it would publish more findings as investigators confirm them. It also asked users to rely on official channels instead of unverified posts. WEMIX may contact law enforcement agencies if tracing work identifies evidence that requires formal action.

Stablecoin loses peg during planned USDC.e transition

WEMIX$ was designed to track the U.S. dollar on the WEMIX3.0 network. CoinGecko data showed the stablecoin falling close to its recorded low after the breach, with a weekly decline of about 98.9%. The price move followed the unauthorised minting and rapid conversion of newly created tokens, although the final financial loss remains separate from the amount minted.

The incident came while WEMIX was already replacing WEMIX$ with USDC.e across its gaming and financial services. In March, the company announced that WEMIX PLAY would change its base currency from WEMIX$ to USDC.e. It scheduled the main service transition for April and began closing or reorganising older WEMIX$ pools. The breached contract therefore belonged to a stablecoin system already moving toward reduced use.

New breach follows the 2025 Play Bridge hack

The latest event follows a separate WEMIX security breach in February 2025. As crypto.news previously reported, attackers removed about 8.6 million WEMIX tokens, then worth roughly $6.04 million, from the Play Bridge Vault. WEMIX shut the affected server and reported the case to the Seoul Metropolitan Police Agency’s cyber investigation unit.

That earlier incident also led to criticism because WEMIX disclosed it several days after discovering the breach. South Korea’s major exchanges later delisted WEMIX in June 2025. As related crypto.news coverage noted, Upbit, Bithumb, Coinone, Korbit and Gopax coordinated the action through the Digital Asset Exchange Alliance. The new contract breach occurred as the project approached the period when a future domestic relisting application could become possible.

WEMIX has not released a final attack report, named the source of the stolen owner credentials or confirmed the total unrecovered loss. Its latest response focuses on wallet tracing, service suspensions, asset-freeze requests and contract analysis. Further notices are expected to clarify whether the attacker exploited code, obtained a private key or accessed an internal account with contract-control rights.

BitMart’s planned wind-down is starting to show up in customer withdrawal behavior, according to blockchain monitoring and ongoing user reports. While withdrawals remain available, analytics tracking suggests activity has slowed sharply after the exchange moved toward ending services.

On Monday, Lookonchain reported that only 58 wallets withdrew roughly $805,000 over more than 24 hours, and that BitMart had not processed any withdrawals during the most recent eight-hour window the firm tracked. Separately, multiple users on X described delays or inconsistencies with withdrawal processing, though the claims could not be independently verified.

Key takeaways

• Lookonchain data indicates withdrawal activity from BitMart slowed to near-zero during at least one tracked eight-hour period.
• Users on X reported withdrawal freezes and transactions marked as completed without clear on-chain processing, but these reports were not verified.
• BitMart has said withdrawals will continue, though requests may undergo additional compliance and security checks.
• BitMart’s closure schedule remains under focus: trading is set to end Aug. 26, with full cessation expected by Jan. 31, 2027.
• BitMart’s token (BMX) continued to fall after the shutdown announcement, reflecting deteriorating market sentiment.

Withdrawal activity appears to stall as wind-down proceeds

Lookonchain’s Monday update framed the slowdown through wallet-level monitoring, with 58 wallets withdrawing about $805,000 over a little more than a day. The same report said BitMart did not process withdrawals during the latest eight-hour segment it analyzed, suggesting operational throttling or slower throughput during the wind-down transition.

Beyond the analytics snapshot, social media users continued to post about withdrawal issues. One X user said they received an email claiming a USDT withdrawal had been completed, while their account still showed an “on-chain withdrawal freeze” and the transaction was not processed on-chain. Another user claimed a $30 test withdrawal remained pending for more than 30 minutes. These accounts were presented as individual experiences and were not confirmed by independent evidence in the reporting.

For customers, the practical question is whether BitMart can convert “orderly wind-down” promises into consistently processed outflows. Even when withdrawals remain technically enabled, delays can intensify concern—especially if customers suspect internal holds, address checks, or longer verification queues than before.

BitMart says withdrawals remain available, but checks may tighten

BitMart previously told customers that withdrawals would still be supported while operations unwind. However, it warned that withdrawal requests could face additional compliance and security controls. The exchange’s notice indicated that review processes may include checks of customer identity details, login devices, withdrawal addresses, trading history, and sources of funds.

BitMart also suggested it might request further proof, including identity verification, confirmation of address details, evidence relating to the source of funds, and—where relevant—ownership of the receiving wallet. That framework matters because it points to a mechanism for why withdrawals could appear slower even if the exchange intends to process them eventually.

Cointelegraph attempted to obtain comments from BitMart but did not receive a response before publication. That leaves customers and observers reliant on the exchange’s published guidance, third-party tracking, and user reports to gauge whether checks are running normally or becoming a bottleneck.

Trading ends in stages; platform closure timetable remains the same

The withdrawal scrutiny comes after BitMart announced a staged exit from its business. In its Sunday update, the exchange said it would stop accepting new registrations and deposits, while restricting new spot orders and futures positions.

According to the schedule outlined at the time, trading services are expected to end on Aug. 26. The exchange also stated that the platform will cease operations entirely on Jan. 31, 2027. This longer runway means BitMart’s ability to keep customer exits working—especially during the period leading up to Aug. 26—may be one of the clearest near-term signals of how smoothly it intends to handle assets.

As the wind-down progresses, blockchain visibility adds another layer to the story. Arkham, via its entity explorer, attributed about $69 million in crypto assets to BitMart-linked wallets on Monday, down from roughly $102 million on July 6. While wallet attribution does not automatically confirm which assets remain available to customers at any given moment, the trend is consistent with gradual movements and reallocations during the closure process.

BMX token slumps; acquisition questions return

BitMart’s token performance has also reflected mounting concerns around exchange risk. CoinGecko data showed BMX trading near $0.057 on Monday and down about 81.5% over seven days. Earlier in the week, the token was reportedly around $0.31 late Friday after BitMart’s shutdown plans became public.

Token declines during an exchange wind-down are common, but the magnitude can indicate how aggressively traders are repricing uncertainty around liquidity, support, and distribution mechanics during cessation. For tokenholders and observers, it also underscores the market’s expectation that the transition will not be smooth for all participants.

The closure has revived questions about consolidation in centralized exchanges. Changpeng Zhao, Binance co-founder, commented on X that acquiring a centralized exchange can be more complicated than buying other businesses. He argued that buyers could inherit security vulnerabilities, including backdoors left by prior teams, adding that acquisitions are possible but require greater scrutiny.

In that context, BitMart’s winding down may affect how potential acquirers evaluate operational continuity, customer asset handling processes, and technical risk. Even where an acquisition is feasible on paper, the practical challenges of verifying controls and safeguarding assets can be substantial—especially for platforms already reducing activity and limiting new access.

Looking ahead, customers and market participants should watch whether withdrawal processing returns to steady throughput as checks are completed and whether third-party monitoring shows sustained transaction activity rather than intermittent gaps. Until BitMart demonstrates consistent outflows across different assets and user reports, uncertainty around the final stages of the wind-down is likely to remain a central issue.