Mercado Bitcoin hack: attacker drained addresses after containment announcement, researcher says
Attacker moved funds hours after containment claim
Blockchain research firm Bitquery says an attacker drained 36,042 Ethereum deposit addresses linked to Brazilian exchange Mercado Bitcoin after the exchange said it had contained a security breach.
Mercado Bitcoin is an exchange, a platform where people buy and sell crypto. Bitquery says the addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time on November 2. The exchange announced at 9:56 a.m. Brazil time that day that it had quickly contained the incident.
Key points
- Bitquery estimates $48.6 million was stolen across 11 blockchains, which are shared public record systems for transactions.
- Mercado Bitcoin's updated FAQ puts affected assets at about $36.3 million.
- Initial estimates put the amount above $40 million.
- The exchange says it will cover user losses with its own funds.
- Account viewing is planned to reopen on November 9, with withdrawals and trading still suspended at first.
What Bitquery says it found
Bitquery traced more than $48 million in stolen assets across 11 networks. It says the withdrawals were authorised directly by the deposit addresses.
A customer deposit address works like a personal receiving account for crypto. The exchange later gathers coins into a shared online wallet, called a hot wallet, for everyday transactions. Moving funds from a deposit address requires its private key, the secret that authorises transfers.
Bitquery says the activity suggests the attacker had access to the private keys or to a system able to sign transactions for those addresses. The researchers said each address would need its own key, or access to a signing system, and warned that exchanges often generate deposit keys from a single master key. On that basis, they warned the attacker may still be able to access other customer addresses.
The 36,042 Ethereum addresses held roughly $266,000, according to Bitquery. That is a small part of the total tracked, but the funds could still be moved after the exchange announcement.
What the exchange has said
Mercado Bitcoin has not explained the gap between its containment claim and the later transfers in its public updates. It has assured customers it will cover user losses with its own funds.
Its reopening plan starts on November 9 with balance viewing only. Deposits, withdrawals and trading have no restart date in the plan described in the source.
What is confirmed and what is disputed
Both sides report a security incident involving customer deposit addresses. The timing of the transfers and the total amount stolen are disputed.
Bitquery's figure of $48.6 million is higher than the exchange's $36.3 million estimate. The source does not provide a breakdown that explains the difference.
Warnings for customers
Bitquery warns customers not to reuse old deposit addresses until the exchange confirms they are safe. That warning follows its claim that keys for those addresses may still be exposed.
What happens next
Mercado Bitcoin plans to allow account viewing from November 9. Withdrawals, deposits and trading will remain suspended initially, and the source gives no date for them to resume.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.