Mercado Bitcoin Hack Ran 4 Hours Past Containment [2026] - shattered.io

The exchange posted its containment statement at 12:56 UTC, leaving 4 hours of reported activity after the statement and 29 minutes before it.

Put plainly, the public statement and the ledger told different stories for most of an afternoon in Brazil, where 12:56 UTC corresponds to 9:56 a.m. in São Paulo.

The core question is simple. What does a company mean when it says an attack is contained, and how should customers, partners and engineers read that word when the ledger disagrees?

Scale and Speed of the Breach

Blockchain data provider Bitquery traced transfers out of Ethereum customer deposit addresses tied to Mercado Bitcoin. Its data showed activity from 36,042 of those addresses across a window that opened at 12:27 UTC and closed at 16:56 UTC on November 2.

The full activity window runs 4 hours and 29 minutes, or 269 minutes. Spread 36,042 addresses across that span and you get an average of about 134 addresses per minute, a figure that points to automation rather than a person working through a list by hand.

The timing also shows the attack was already underway before the company spoke. Twenty-nine minutes of draining preceded the containment message.

Claims and Discrepancies

The exchange’s first message made four claims. It had spotted a security incident in one of its systems. It had quickly contained the problem. It had suspended deposits and withdrawals as a preventive measure. And, according to the company, customers had lost no money and no data had leaked.

Each claim carries a different level of risk. Pausing deposits and withdrawals is an action the exchange controls, so we can take it at face value. The no-customer-losses line is a forecast about the end state of the incident, which the company cannot fully know in the first hours.

The containment line is the one the blockchain data challenges. The exchange has not, in the material we reviewed, withdrawn its containment claim or explained the later transfers.

Later, Mercado Bitcoin said roughly $38 million in assets were involved and that $11 million had been blocked with the help of Tether, Circle, Paxos, BRL1 and Chainalysis.

The Numbers Remain Unconfirmed

The exact total remains unconfirmed. Reported estimates run from about $38 million, which is the figure Mercado Bitcoin used, to about $46.3 million in other published tallies.

Hypernative, a security firm, separately flagged more than $40 million in suspicious transfers linked to the incident across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron.

The spread itself is about $8.3 million, or roughly 22% of the lower figure. That is large enough to change how regulators and insurers view the case, and it is why the no-customer-losses claim needs a proper accounting behind it.

Measured against the $38 million the exchange reported, $11 million is about 29% of the total. Against Hypernative’s $40 million floor it is about 27%, and against the $46.3 million upper estimate it is about 24%.

Limits of Freezes

Freezing also has limits. Native Bitcoin and Solana’s SOL cannot be frozen by a stablecoin issuer, and an attacker who moves quickly into those assets or into mixers narrows the window.

Measured against the $38 million the exchange reported, $11 million is about 29% of the total. Against Hypernative’s $40 million floor it is about 27%, and against the $46.3 million upper estimate it is about 24%.

These percentages show that freezes recovered a meaningful slice but left most of the value outside the exchange’s reach.

The wider industry shows the same pattern. The T3 Financial Crime Unit ended after $250M in freezes, a reminder that coordinated freezing works but depends on a small set of issuers and trackers staying engaged.

What Comes Next

There is a practical lesson for engineers in that breadth. An incident that spans thousands of per-customer addresses cannot be closed by pausing one service or rotating one key and calling it done.

Containment has to cover every path that can sign or move funds, and the team needs to verify it against the chain, not against an internal dashboard.

Multi-chain exposure also complicates cleanup. Each network has its own explorers, its own freeze mechanisms and its own set of bridges and swap venues where stolen assets can disappear.

A response team that works one chain at a time will fall behind an attacker who works all of them at once.