From Decrypt · By Jose Antonio Lanz
In brief
Bitquery says the attacker drained 36,042 Ethereum deposit addresses for nearly four hours after Mercado Bitcoin announced containment.
The researchers tracked $48.6 million across 11 networks, above the exchange's latest estimate of $36.3 million.
Mercado Bitcoin plans to reopen account viewing on November 9, but withdrawals and trading will remain suspended initially.
An attacker drained Mercado Bitcoin-linked deposit addresses nearly four hours after the Brazilian exchange said it had contained a security breach, new blockchain research shows.
Bitquery's analysis, updated Thursday, traces more than $48 million in stolen assets across 11 blockchains. Its findings challenge the exchange's claim that it stopped the attack quickly.
The Bitcoin exchange announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
PredictCryptoBTC Lows in November
55,0004%YesNo57,5006%YesNo60,0008%YesNo62,50013%YesNo65,00020%YesNo+5 more outcomes+4 more outcomesNEW$0.00 volumeCloses: Dec 1, 2026, 04:59 UTCCloses: Dec 1, 2026, 04:59 UTCThose addresses held roughly $266,000, a small fraction of the total theft. But the attacker could still move those funds after the exchange’s announcement.
A customer deposit address works much like a personal receiving account for cryptocurrency. The exchange later gathers those coins into a shared online wallet, called a hot wallet, to process everyday transactions. Moving funds from a deposit address requires its private key, the secret that authorizes transfers.
Bitquery says the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or to a system capable of signing transactions on their behalf.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained. They warned that exchanges typically generate deposit keys from a single master key, meaning the attacker may still be able to access other customer addresses.
BitcoinBTC · USD$76,031−3.58%Oct 29Oct 31Nov 2Nov 4Nov 5$80.7k$79.1k$77.5k$76.0k24h HighHigh$80,88224h LowLow$75,573VolVol$1.9BMarket projectionsOdds by MyriadTodayAbove $76,000Above $76k52% chanceThis weekAbove $76,000Above $76k52% chance→Buy Bitcoin with USDCPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →The amount stolen is also disputed. Initial estimates put the amount above $40 million, while Mercado Bitcoin's updated FAQ now puts affected assets at about $36.3 million. Bitquery estimates that $48.6 million was stolen across 11 blockchains.