Key Highlights:
- Blockchain analysis reveals hackers continued siphoning crypto assets from Mercado Bitcoin for approximately four hours after the exchange claimed the breach was contained.
- Blockchain intelligence platform Bitquery traced $48.6 million in stolen funds across 10 blockchains, impacting 36,042 customer deposit addresses on Ethereum.
- Mercado Bitcoin pledged to fully compensate impacted customers, while industry partners Tether, Circle, and Chainalysis coordinated to freeze more than $15 million in stolen assets.
Fresh on-chain intelligence reveals that attackers continued draining funds from Brazilian cryptocurrency exchange Mercado Bitcoin for roughly four hours after the platform publicly declared that a major security breach had been contained. The newly analyzed timeline raises serious questions regarding the exchange’s internal incident response and points to deeper unauthorized access into the systems responsible for handling user deposit infrastructure.
Timeline Discrepancies and Compromised Deposit Addresses
According to on-chain analytics provided by blockchain data platform Bitquery, the cyberattack saw 36,042 customer deposit addresses on the Ethereum network systematically drained between 12:27 UTC and 16:56 UTC on November 2. However, Mercado Bitcoin had stated earlier that same day at 12:56 UTC that the attack was contained. Despite that assurance, illicit fund transfers persisted for several hours afterward.
The findings cast significant doubt on the actual speed and effectiveness with which Mercado Bitcoin gained control over the security incident. Analysts suggest that the prolonged unauthorized activity indicates the attacker gained direct access to the operational systems used to manage and process customer deposit addresses, allowing them to systematically sweep funds beyond the initial detection period. Mercado Bitcoin was not immediately available for comment regarding the timing discrepancies.
Full Extent of Stolen Funds and Coordinated Freeze
The total financial fallout from the breach has also expanded beyond initial estimates. While early reports pegged the theft at $40 million, Bitquery’s multi-chain tracing identified $48.6 million in stolen crypto assets spread across 10 distinct blockchains.
In response to the incident, Mercado Bitcoin pledged to reimburse all affected users and cover all losses resulting from the hack. At the same time, joint containment efforts involving stablecoin issuers Tether and Circle, along with blockchain forensic firm Chainalysis, successfully immobilized more than $15 million of the stolen digital assets before the attacker could fully launder or cash them out.
Links to BitMart Security Incidents
Blockchain investigators also uncovered connections bridging this exploit to previous malicious campaigns. Bitquery’s trace analysis established operational links between the infrastructure used in the Mercado Bitcoin breach and separate wallet addresses believed to belong to cryptocurrency exchange BitMart, suggesting potential overlap in threat actor activity or shared exploit mechanisms targeting centralized digital asset platforms.
Why This Matters
The incident at Mercado Bitcoin underscores critical vulnerabilities in how centralized cryptocurrency exchanges secure internal deposit-sweeping mechanisms and automated treasury tools. It also highlights the growing disconnect that can occur between real-time public relations statements and actual on-chain reality during live security incidents. Because public ledgers provide transparent, immutable records of asset movement, crypto exchanges face unprecedented scrutiny if containment claims do not match on-chain transaction flows. Additionally, the rapid freezing of over $15 million illustrates the expanding role of centralized stablecoin issuers and analytics firms in mitigating multi-chain financial crimes.
Frequently Asked Questions
How much money was stolen in the Mercado Bitcoin hack?
Blockchain intelligence firm Bitquery traced $48.6 million in stolen assets across 10 different blockchains, higher than the initial estimates of $40 million.
Were customer funds protected following the exploit?
Yes. Mercado Bitcoin announced a commitment to fully cover all user losses caused by the cyberattack. Additionally, collaborative efforts by Tether, Circle, and Chainalysis resulted in freezing more than $15 million worth of the illicitly transferred funds.
Why did fund transfers continue after Mercado Bitcoin announced the attack was contained?
On-chain records indicate that 36,042 Ethereum deposit addresses were drained until 16:56 UTC on November 2, roughly four hours after Mercado Bitcoin’s containment announcement at 12:56 UTC. Analysts note this pattern suggests the intruder maintained access to backend systems managing customer deposit infrastructure longer than the exchange initially realized.
