Blockchain data contradicts Mercado Bitcoin's claim it "contained" its hack
Blockchain analytics firm Bitquery says a Mercado Bitcoin attacker kept draining customer deposit addresses for nearly four hours after the Brazilian exchange declared the breach contained, with losses it puts at $48.6 million across 11 chains.
Mercado Bitcoin, Brazil's largest crypto exchange, told customers on November 2 that it had quickly contained a security breach. On-chain forensics published this week say the draining continued for nearly four hours after that announcement.
According to analytics firm Bitquery, in an analysis updated Thursday and reported by Decrypt, the attacker emptied 36,042 Ethereum customer deposit addresses between 9:27 a.m. and 1:56 p.m. Brazil time on November 2. The exchange's containment notice went out at 9:56 a.m. — meaning, per Bitquery's timeline, roughly four more hours of unauthorized transfers followed the "contained" claim. Those particular Ethereum addresses held about $266,000, a small slice of the total, but the timing is the point: the funds moved after the exchange said the incident was stopped.
Bitquery says the withdrawals were authorized directly by the deposit addresses themselves — which, the firm notes, means the attacker held the private keys for those addresses or had access to a system that could sign on their behalf. Because exchanges typically derive deposit keys from a single master key, Bitquery warned the attacker may still be able to reach other customer addresses, and advised users not to reuse old deposit addresses until Mercado Bitcoin confirms they are safe.
The size of the loss is disputed. Mercado Bitcoin's updated FAQ puts affected assets at about $36.3 million; earlier estimates ran above $40 million; Bitquery traces $48.6 million across 11 blockchains — about $12 million above the exchange's own figure. Mercado Bitcoin's public updates have not explained the gap between its containment claim and the later transfers, per Decrypt. The company said it will cover user losses with its own funds.
Key facts
- Attacker drained 36,042 ETH deposit addresses from 9:27 a.m. to 1:56 p.m. Brazil time, Nov 2; containment announced 9:56 a.m. — Bitquery, via Decrypt.
- Those ETH addresses held ~$266,000; transfers authorized directly by the deposit addresses — Bitquery.
- Total stolen: $36.3M (Mercado Bitcoin FAQ) / >$40M (initial estimates) / $48.6M across 11 chains (Bitquery).
- Mercado Bitcoin plans to reopen balance viewing Nov 9; deposits, withdrawals and trading suspended with no restart date. — Decrypt.
- Exchange says it will cover user losses from its own funds. — Mercado Bitcoin, via Decrypt.
The real-world read
The headline tension is a walk-back by the numbers: an exchange said "contained" at 9:56 a.m., and independent chain data shows funds still leaving customer addresses until nearly 2 p.m. Mercado Bitcoin hasn't reconciled that gap publicly. The firm raising it, Bitquery, sells blockchain-analytics products, so its $48.6 million figure is an interested estimate — but it is sourced to on-chain records and sits above the exchange's own $36.3 million, not below, which is the harder direction to spin. Bitquery's master-key warning is a hypothesis, not a confirmed finding: it says the signing pattern is consistent with broader key exposure, and the exchange has not said whether its key architecture is affected. What's conspicuously unsaid is how the attacker got signing ability in the first place, and why "contained" was declared while withdrawals were ongoing.
Not financial advice. This is reporting on a developing security incident; figures may be revised as the investigation continues.