Mercado Bitcoin hack continued hours after exchange said attack was contained, report finds

Blockchain data platform Bitquery found that the attacker drained 36,042 customer deposit addresses on Ethereum between 12:27 and 16:56 UTC on Nov. 2, despite Mercado Bitcoin announcing at 12:56 UTC that the breach had been contained. The findings raise questions about how quickly the exchange brought the attack under control.

Extended Breach

The compromised addresses held about $266,000. In total, Bitquery traced $48.6 million in stolen assets across 10 blockchains, exceeding the initial $40 million reported. Mercado Bitcoin pledged to cover all user losses and received help from partners including Tether, Circle and Chainalysis, who froze over $15 million.

Linked Attacks

The investigation revealed connections to a separate attack on wallets believed to belong to crypto exchange BitMart. The same attacker-controlled address received funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin breach. BitMart founder Sheldon Xia confirmed a Nov. 2 hack and suspects a link to the Mercado Bitcoin attack.

Exchange Response

The overlap suggests the attacker may have gained access to infrastructure used by multiple exchanges. Mercado Bitcoin suspended deposits and withdrawals following the attack and plans to reopen its website in view-only mode on Nov. 9, though no date has been set for restoring normal operations.