Cryptocurrency exchange BitMart has been hacked with about $150 million in cryptocurrency stolen.

The hack of the exchange, run by GBM Global Holding Co. Ltd., took place late Saturday. It involved the theft of cryptocurrency from an Ethereum hot wallet and a Binance Smart Chain hot wallet.

How the wallets were breached is not known. BitMart said the attack was a “large-scale security breach” and that it’s “still concluding the possible methods used.”

BitMart claimed that the two wallets only carried a small percentage of assets on BitMart and that other wallets used by the company are secure and unharmed. A thorough security review is underway and withdrawals have been temporarily suspended until further notice.

The company provided further details on Twitter, saying it will work closely with law enforcement to solve the issue. It said it’s tracking the hackers’ activities and attempting to recover the stolen assets. Customers were also warned to be aware of scammers, noting that BitMart will never ask users to transfer funds to any address to solve problems or ask for personal information such as login detail or verification code.

An exact list of which cryptocurrencies were stolen is open to some speculation. Blockchain security and data analytics company PeckShield Inc. was among the first to notice that BitMart may have been hacked, writing that large amounts of meme tokens such as Shiba coin had been withdrawn, along with the stablecoin USDC.

CNBC reported today that upon stealing the various forms of cryptocurrency, the hackers used the decentralized exchange aggregator known as “1inch” to exchange the tokens for Ethereum. From there, the ETH was transferred to the Tornado Cash tumbler to obfuscate the movement of the stolen cryptocurrency.

A cryptocurrency tumbler is a service that mixes potentially identifiable cryptocurrency funds with others to obscure the trail back to the funds source. It’s best known for operating on the dark web to provide criminals with a way to hide stolen cryptocurrency, but surprisingly, Tornado Cash is operating openly on the internet and is pitching itself as a privacy service.

BitMart was founded in 2017 and offers a fully integrated digital asset platform. According to Crunchbase, the company has raised $10 million in venture capital from investors including Alexander Capital Ventures, Alpha Square Group, Chaos Ventures and Fenbushi Capital.

Image: BitMart