Mercado Bitcoin's attacker kept draining wallets for hours after the exchange said it was "contained"

Brazilian exchange Mercado Bitcoin told the public its Nov. 2 breach was under control at 12:56 UTC that day. On-chain data says the attacker was still emptying customer wallets until 16:56 UTC — roughly four hours later.

That timeline comes from blockchain analytics firm Bitquery, reported by CoinDesk on Nov. 5. Bitquery traced the attacker draining 36,042 Ethereum customer deposit addresses between 12:27 and 16:56 UTC, holding about $266,000 on that chain alone. The continued outflows after the "contained" statement suggest the attacker retained access to the systems Mercado Bitcoin uses to manage customer deposits — and raise a direct question about how quickly the exchange actually regained control.

Bitquery puts total losses at $48.6 million across 10 blockchains, above the roughly $40 million first reported in the immediate aftermath. Mercado Bitcoin has said it will cover all user losses, and Bitquery notes that partners including Tether, Circle and Chainalysis helped freeze more than $15 million.

There may be a second victim. Bitquery says the same attacker-controlled address began receiving funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin breach, and attributes about $391,000 in losses from those wallets — which it links to exchange BitMart. BitMart founder Sheldon Xia confirmed to CoinDesk that BitMart was hacked on Nov. 2 and said its preliminary investigation points to the same group. Xia did not confirm Bitquery's $391,000 figure, and the cause of both breaches remains unknown.

Key facts

• Attacker drained 36,042 Ethereum deposit addresses (~$266,000) between 12:27 and 16:56 UTC on Nov. 2; exchange said breach was "contained" at 12:56 UTC — Bitquery, via CoinDesk.
• Total traced losses: $48.6 million across 10 blockchains, above the ~$40 million first reported — Bitquery.
• Over $15 million frozen with help from Tether, Circle and Chainalysis; Mercado Bitcoin pledged to cover all user losses — CoinDesk.
• Same attacker tied to ~$391,000 from wallets Bitquery links to BitMart; figure unconfirmed by BitMart — Bitquery / CoinDesk.
• BitMart founder Sheldon Xia confirmed a Nov. 2 hack and suspects the same group — Xia, via CoinDesk.
• Mercado Bitcoin set to reopen in view-only mode Nov. 9; no date yet for deposits or withdrawals — CoinDesk.

The real-world read The gap between the "contained" statement and the on-chain record is the story. If Bitquery's timeline holds, the exchange declared victory while the attacker was still working — either it misjudged its own systems or it spoke too soon. Note the attribution chain: the loss figures and the four-hour window come from one analytics firm's tracing, not from the exchange, which wasn't reachable for comment and hasn't confirmed the $48.6 million total. The BitMart link is thinner still — one founder's "preliminary" suspicion plus Bitquery's wallet attribution, with the dollar figure explicitly unconfirmed. Treat the cross-exchange theory as a lead, not a finding. What's conspicuously unanswered: how the attacker got in, and whether other exchanges share the infrastructure that was compromised.

Opinion, and whose Xia's view that a single group hit both exchanges is his firm's preliminary read, not an established fact. Bitquery's framing that the findings "cast doubt" on Mercado Bitcoin's response is the analytics firm's characterization; the exchange has not responded to it.

This is news, not financial advice.