Mercado Bitcoin Said Its Hack Was Contained, But Blockchain Data Tells a Different Story - Yahoo Finance
An attacker drained Mercado Bitcoin-linked deposit addresses nearly four hours after the Brazilian exchange claimed it had contained a security breach, according to new blockchain research.
Bitquery's analysis, updated Thursday, traces more than $48 million in stolen assets across 11 blockchains. Its findings challenge the exchange's claim that it stopped the attack quickly. The Bitcoin exchange announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident.
Extended Breach Timeline
Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time. Those addresses held roughly $266,000, a small fraction of the total theft. But the attacker could still move those funds after the exchange's announcement.
That needs a key for each address, or a way into the system that signs for them.
Disputed Amounts
The amount stolen is also disputed. Initial estimates put the amount above $40 million, while Mercado Bitcoin's updated FAQ now puts affected assets at about $36.3 million. Bitquery estimates that $48.6 million was stolen across 11 blockchains.
Mercado Bitcoin's public updates have not explained the gap between its containment claim and the later transfers. The company assured customers it would cover user losses with its own funds.
Reopening Plan
Bitquery warns customers against reusing old deposit addresses until the exchange confirms they are safe. Mercado Bitcoin's reopening plan begins November 9 with balance viewing only; deposits, withdrawals and trading have no restart date.
Related
