Mercado Bitcoin Said Its Hack Was Contained, But Blockchain Data Tells a Different Story

The Brazilian cryptocurrency exchange announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. However, Bitquery's analysis, updated Thursday, traces more than $48 million in stolen assets across 11 blockchains, directly challenging the exchange's claim.

According to the research, 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time. Those addresses held roughly $266,000, a small fraction of the total theft, but the attacker continued moving funds after the exchange's announcement.

Security Breach Details

A customer deposit address functions like a personal receiving account for cryptocurrency. The exchange later gathers these coins into a shared online wallet, called a hot wallet, to process everyday transactions. Moving funds from a deposit address requires its private key, the secret that authorizes transfers.

Bitquery states the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or a system capable of signing transactions on their behalf. "That needs a key for each address, or a way into the system that signs for them," the researchers explained.

Disputed Amounts

The amount stolen remains disputed. Initial estimates put the figure above $40 million, while Mercado Bitcoin's updated FAQ now cites affected assets at about $36.3 million. Bitquery estimates $48.6 million was stolen across 11 blockchains, creating a significant gap between the exchange's claims and the blockchain evidence.

Mercado Bitcoin has not publicly explained the discrepancy between its containment claim and the later transfers. The company has assured customers it will cover user losses with its own funds and plans to reopen account viewing on November 9, though deposits, withdrawals, and trading remain suspended with no restart date set.