Brazilian cryptocy exchange Mercado Bitcoin is facing increased scrutiny after blockchain investigators discovered that hackers continued draining customer deposit wallets for approximately four hours after the company announced it had contained a major cyberattack. According to a November 5 investigation by blockchain analytics firm Bitquery, attackers stole approximately $48.6 million across 11 blockchain networks, exceeding the roughly $40 million initially reported. The investigation revealed that hackers emptied 36,042 Ethereum customer deposit addresses during the November 2 attack, raising serious questions about the exchange’s ability to secure its wallet infrastructure. Researchers also identified connections to a separate security breach involving BitMart, suggesting that the same attackers may have targeted multiple cryptocy exchanges. Despite the mounting losses, Mercado Bitcoin has pledged to cover customer funds while working with blockchain security companies and stablecoin issuers to recover stolen assets.
On November 2, Mercado Bitcoin, one of Brazil’s largest cryptocy exchanges, announced that it had identified and quickly contained a cybersecurity incident affecting its platform.
However, a subsequent investigation by Bitquery revealed that unauthorized transactions continued for hours after the exchange’s public statement.
According to blockchain transaction records, the attacker began draining Ethereum customer deposit addresses at approximately 12:27 UTC.
Mercado Bitcoin publicly announced that the breach had been contained at 12:56 UTC, just 29 minutes after the observed deposit-address draining began.
Despite that announcement, the attacker continued transferring cryptocy from affected wallets until approximately 16:56 UTC, nearly four hours later.
The investigation identified three critical points in the attack timeline:
12:27 UTC, November 2: Hackers began draining Ethereum customer deposit addresses.
12:56 UTC: Mercado Bitcoin announced that the security incident had been contained.
16:56 UTC: The final unauthorized Ethereum deposit-address transfers identified by Bitquery occurred.
The discrepancy raises questions about whether Mercado Bitcoin had completely identified the compromised infrastructure when it announced that the incident was under control.
Although the exchange may have contained portions of the original attack, the continued unauthorized transfers suggest that the attackers retained access to certain wallet-management functions.
Mercado Bitcoin had not publicly explained the discrepancy between its containment announcement and the subsequent blockchain activity at the time of the report.
Bitquery’s forensic investigation identified approximately $48.6 million in cryptocy losses, significantly exceeding the initial estimates surrounding the attack.
The stolen assets were traced across 11 blockchain networks, demonstrating the extent of the exchange’s compromised cryptocy infrastructure.
Earlier reports placed the losses at approximately $40 million across at least 10 networks.
However, additional blockchain analysis uncovered more unauthorized transactions, increasing the estimated total.
Ethereum accounted for the largest share of the stolen assets, with investigators identifying approximately $29.5 million transferred from a primary Ethereum hot wallet.
Bitcoin represented another substantial portion of the losses, while additional assets were stolen across several other blockchain networks.
The investigation also revealed that attackers targeted multiple types of cryptocy holdings rather than concentrating on a single digital asset.
These included Ethereum (ETH), Bitcoin (BTC), Tether (USDT), USD Coin (USDC) and numerous smaller tokens.
According to Bitquery, the attackers initially drained exchange-controlled hot wallets before targeting individual customer deposit addresses.
This sequence suggests that the attackers gained access to infrastructure capable of authorizing transactions across different parts of Mercado Bitcoin’s wallet system.
The precise method used to compromise that infrastructure remains under investigation.
One of the most concerning discoveries involved the compromise of 36,042 customer deposit addresses on Ethereum.
Cryptocy exchanges typically assign customers individual blockchain addresses for receiving deposits.
Once a customer transfers cryptocy to one of these addresses, the exchange credits the customer’s account and may later consolidate the assets into larger operational wallets.
These consolidated wallets, commonly known as hot wallets, allow exchanges to process withdrawals and manage liquidity.
According to Bitquery, the attackers were able to initiate transactions directly from thousands of individual deposit addresses.
The affected Ethereum addresses contained approximately $266,000, a relatively small portion of the overall theft.
However, the significance of the finding extends beyond the amount stolen.
To authorize transactions from those addresses, the attackers would have needed access to the corresponding private keys or a compromised system capable of signing transactions on their behalf.
This suggests that the breach may have extended beyond a single compromised hot wallet.
Researchers also observed attackers using funds from certain deposit addresses to pay Ethereum network transaction fees, allowing them to extract additional tokens from other compromised addresses.
The activity demonstrates a level of operational control that could complicate efforts to secure the exchange’s infrastructure.
Although investigators identified extensive unauthorized wallet activity, the full technical cause of the breach has not been publicly established.
The investigation uncovered another potentially significant development involving cryptocy exchange BitMart.
According to Bitquery, the same attacker-controlled wallet received funds from addresses believed to be associated with BitMart before the Mercado Bitcoin attack.
The suspicious transactions involved assets transferred through blockchain networks including Base, Arbitrum and Optimism.
CoinDesk reported that Bitquery initially attributed approximately $391,000 in additional losses to wallets believed to belong to BitMart.
Bitquery’s updated investigation estimated the amount at approximately $424,000, although BitMart has not independently confirmed that figure.
Sheldon Xia, founder of BitMart, confirmed that the exchange experienced a cybersecurity incident on November 2.
Xia also indicated that the company’s preliminary investigation suggested a possible connection to the group responsible for the Mercado Bitcoin breach.
The overlapping transaction activity raises the possibility that the attackers exploited infrastructure used by multiple exchanges.
One potential explanation involves compromised third-party wallet-management technology or another shared service provider.
However, investigators have not established whether the exchanges used common infrastructure or whether the attacks originated from the same technical vulnerability.
The precise relationship between the incidents remains under investigation.
Following the breach, Mercado Bitcoin began coordinating with blockchain analytics companies, cryptocy service providers and stablecoin issuers to identify and freeze stolen assets.
The exchange initially reported that approximately $11.2 million had been blocked as part of its emergency response.
CoinDesk subsequently reported that more than $15 million had been frozen with assistance from partners including Tether, Circle and Chainalysis.
Bitquery’s independent on-chain analysis identified approximately $11.8 million in assets frozen directly by stablecoin issuers.
The different figures reflect separate reporting methods and potentially different stages of the recovery effort.
According to Bitquery, several companies participated in freezing compromised assets:
Tether: Approximately $5.9 million in USDT frozen across multiple blockchain networks.
Circle: Approximately $4.3 million in USDC and EURC frozen.
Paxos: Approximately $1.5 million in assets, including PAXG and USDP, frozen.
Additional issuers: Smaller amounts frozen through other token providers.
The response demonstrates how centralized stablecoin issuers can intervene when stolen digital assets remain within their token ecosystems.
Unlike Bitcoin or Ethereum, certain stablecoins contain administrative functions that allow issuers to freeze specific wallet addresses under appropriate circumstances.
These capabilities can help prevent hackers from transferring or liquidating stolen funds.
However, freezing assets does not necessarily mean that the money has been returned to the affected exchange.
The recovery process may require additional investigations, legal procedures and coordination between financial institutions.
Bitquery also documented how the attackers began converting stolen cryptocy into other digital assets following the initial breach.
According to the investigation, approximately $11.9 million worth of tokens were exchanged for Ethereum on November 3 and November 4.
The transactions involved 136 different tokens and were conducted through cryptocy swapping infrastructure associated with MetaMask.
By consolidating numerous smaller digital assets into Ethereum, attackers could simplify the management and potential movement of stolen funds.
Investigators reported that the attacker subsequently controlled approximately 8,678 ETH across 10 Ethereum wallets.
Additional stolen Bitcoin remained in an identified attacker-controlled address at the time of the analysis.
These findings illustrate how blockchain transparency can help security researchers reconstruct the movement of stolen assets even after funds are transferred between wallets.
However, tracing transactions does not guarantee that investigators can identify the individuals responsible or recover the cryptocy.
The attackers may still attempt to move assets through additional blockchain networks, decentralized exchanges or other cryptocy services.
Despite the significant financial damage, Mercado Bitcoin has assured customers that they will not bear losses resulting from the security breach.
The exchange stated that it intends to cover affected balances using its own resources while continuing recovery efforts.
This commitment is particularly important because cryptocy exchanges generally maintain custody of customer assets and are responsible for protecting the infrastructure used to store and transfer those funds.
However, the company’s reimbursement commitment does not mean that all stolen cryptocy has been recovered.
A substantial portion of the assets identified by blockchain investigators remained outside the exchange’s control at the time of the report.
Mercado Bitcoin also suspended deposits and withdrawals following the attack to prevent further unauthorized transactions.
The exchange announced plans to reopen its website in view-only mode on November 9, allowing customers to access account information without immediately restoring trading or cryptocy transfers.
No confirmed date had been announced for the full resumption of deposits and withdrawals.
The gradual reopening reflects the challenges cryptocy exchanges face when restoring operations after a major wallet infrastructure compromise.
Before normal activity can resume, security teams must establish that compromised credentials and transaction-signing systems can no longer be exploited.
The investigation highlights a major cybersecurity challenge facing centralized cryptocy exchanges.
Unlike decentralized wallets, where individual users control their own private keys, centralized exchanges typically manage large numbers of customer deposit addresses through internal custody infrastructure.
This arrangement allows exchanges to provide convenient trading and withdrawal services but also creates concentrated security risks.
If attackers compromise the systems responsible for managing private keys or authorizing transactions, they may gain access to numerous wallets simultaneously.
The Mercado Bitcoin attack illustrates several vulnerabilities that cryptocy exchanges must address, including unauthorized access to wallet-signing infrastructure, insufficient separation between hot wallets and customer deposit systems, and delays in detecting continued malicious activity.
The incident also raises questions about how exchanges communicate security breaches to customers.
Announcing that an attack has been contained while unauthorized transactions continue can create uncertainty about the effectiveness of the institution’s security response.
Blockchain analytics platforms provide an additional layer of transparency because independent investigators can examine public transaction records and compare them with official company statements.
In this case, Bitquery’s findings revealed continued unauthorized activity that was not apparent from Mercado Bitcoin’s initial announcement.
The Mercado Bitcoin breach represents another significant cybersecurity incident in a year marked by major cryptocy thefts and increasingly sophisticated attacks against digital asset infrastructure.
The discovery that hackers continued draining wallets for hours after the exchange announced containment raises important questions about incident response procedures, custody security and public disclosure practices.
The potential connection to BitMart introduces additional concerns about whether attackers are identifying weaknesses shared across multiple cryptocy platforms.
Although investigators have not determined the underlying cause, the incident demonstrates how a compromised wallet-management system could expose large numbers of customer addresses across different blockchain networks.
For Mercado Bitcoin, the immediate challenge is securing its infrastructure, recovering stolen assets and restoring customer confidence.
For the broader cryptocy industry, the attack reinforces the importance of independently verifying security claims through blockchain data and ensuring that compromised transaction-signing systems are completely isolated before declaring an incident contained.
The involvement of Tether, Circle, Paxos and blockchain investigators also demonstrates the growing role of coordinated recovery efforts in responding to cryptocy theft.
However, the continued movement of stolen assets illustrates the limitations of those efforts when attackers maintain control over private keys or wallet authorization systems.
As centralized exchanges become more deeply integrated into global financial markets, maintaining customer trust will require not only stronger cybersecurity protections but also timely, accurate and transparent communication during security incidents.
The Mercado Bitcoin investigation serves as a reminder that declaring a cyberattack contained does not necessarily mean that the attackers have lost access, and independent blockchain analysis can play a critical role in uncovering the full extent of a breach.
Apple, Home Depot, Boeing and ServiceNow have joined a growing group of major U.S. corporations…
House Democrats are reportedly preparing a new cryptocy market structure bill following their victories in…
Binance has released its first detailed investigation into the massive $6.34 billion cryptocy hack on…
Solana Labs has officially launched Leap, a new mobile trading application that allows users to…
Morgan Stanley has become one of the first major U.S. banks to tokenize traditional financial…
The Office of the Comptroller of the Currency (OCC) has introduced its first supervisory framework…