Mentioned in This Article
1. Crypto exchange hack at Mercado Bitcoin outlasted the containment claim
Attackers kept draining customer funds from Brazilian exchange Mercado Bitcoin for roughly four hours after the company announced the breach was contained, according to blockchain analytics firm Bitquery. In this crypto exchange hack on November 2, the firm counts $48.6 million in stolen assets across 10 blockchains, above the $40 million first reported, and links the same attacker to a separate theft at BitMart.
The finding matters because a containment statement is the point at which customers, partners and regulators generally assume the losses have stopped growing. The on-chain record described by Bitquery suggests that assumption did not hold on the day of the attack, and that the intruder retained working access to the exchange's deposit infrastructure well after the public reassurance.
Mercado Bitcoin, one of the larger crypto trading venues in Brazil, did not immediately respond to a request for comment on the analysis. The exchange has so far not publicly explained how the attacker got in, and the cause of the breach remains unknown.
2. What did the blockchain data show about the timeline?
The data shows continued theft after the containment announcement. Bitquery says the attacker emptied 36,042 customer deposit addresses on the Ethereum network between 12:27 and 16:56 UTC on November 2. The exchange had declared the breach contained at 12:56 UTC the same day, only about half an hour after the first of those transfers, which leaves close to four hours of draining that came after its statement.
Deposit addresses are the unique wallet addresses an exchange assigns to individual customers so that incoming transfers can be matched to the right account. Exchanges typically sweep the balances in those addresses into central pooled wallets. An attacker who can move funds out of tens of thousands of such addresses in a single window is usually not guessing at wallets one by one. It implies control over the system that creates, tracks or signs for them.
That is the inference the analysis draws. The pattern suggests the hacker gained access to systems used to manage customer deposits, not merely to a single hot wallet. It also raises a question about how quickly Mercado Bitcoin was able to cut the intruder off, since the activity kept running well past the moment the company described the situation as under control.
Timestamps on a public ledger are precise and difficult to dispute, which is why on-chain evidence often becomes the reference point when an exchange's account of an incident and the observed transfers diverge. Bitquery's reading rests on those transaction records, not on statements from the company, so the discrepancy can be checked by anyone with the relevant addresses.
3. How large were the losses, and who is covering them?
Bitquery traced $48.6 million in stolen assets spread over 10 blockchains. The first public estimate of the loss was $40 million, so the traced total is about $8.6 million higher. Multi-chain thefts are hard to total quickly, because the attacker's activity is scattered across networks with different explorers, tokens and bridging routes, and later tracing frequently raises the early figure.
Mercado Bitcoin has pledged to cover all user losses. In practice that places the financial burden on the exchange itself, not on customers whose deposit addresses were emptied. How the company will fund a loss of this size has not been detailed in the information available, and the higher traced total adds to the amount it has promised to make good.
Recovery efforts have already produced some results. Stablecoin issuers Tether and Circle, working with blockchain intelligence provider Chainalysis, helped freeze more than $15 million of the stolen funds. Issuers of centralized stablecoins can block specific addresses from moving their tokens, which makes freezes one of the few effective tools after a theft, provided they are requested quickly enough that the funds have not yet been swapped into assets nobody can freeze.
The frozen amount is roughly a third of the $48.6 million traced by Bitquery. The remainder was not reported as recovered, and the analysis does not say where those funds currently sit.
4. Is the Mercado Bitcoin attacker tied to a BitMart hack?
Bitquery's investigation points to a link with a separate attack involving wallets it believes belong to crypto exchange BitMart. The firm says the same attacker-controlled address began receiving funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin breach took place. Those three networks are Ethereum layer-2 chains, which process transactions off the main Ethereum network while settling on it.
Bitquery attributed roughly $391,000 in losses to those wallets, with most of the money coming from them. BitMart has not confirmed that figure. The company's founder, Sheldon Xia, said BitMart was hacked on November 2, the same day as the Mercado Bitcoin attack. He added that BitMart's preliminary investigation points to the group responsible for the Mercado Bitcoin breach.
The sequence described by the analysis is notable. Funds arriving at the attacker's address from BitMart-linked wallets before the Mercado Bitcoin theft began would indicate that the intruder was already active against one exchange before moving to the other. The overlap is not proof of a shared cause, but it is consistent with a single actor working through more than one target in one day.
The dollar size of the BitMart portion, about $391,000, is small beside the Mercado Bitcoin losses. Its significance lies in what it suggests about the attacker's methods and reach, not in the amount taken.
5. Could one weakness have exposed several exchanges?
The overlap between the two incidents raises the possibility that the attacker accessed infrastructure used by multiple exchanges. That remains a possibility, not a finding. No cause has been established for either breach, and neither exchange has said that a shared vendor, software component or service was involved.
If a common dependency were behind the attacks, the implications would extend beyond these two companies. Exchanges often rely on third-party providers for wallet management, key custody, deposit monitoring and blockchain node access, and a flaw or compromise at such a provider can expose several clients at once. Investigators generally look for that kind of shared element when the same actor appears across unrelated victims on the same day.
For now, the evidence in the public record is limited to wallet flows and a preliminary statement from BitMart's founder. Establishing whether the two breaches share a root cause will depend on forensic work by the exchanges and their security partners, and on whether they choose to publish findings.
6. Why do containment claims matter after an exchange breach?
When an exchange reports that an attack has been contained, it is telling users that the intruder no longer has access and that the remaining balances are safe. Customers use that statement to decide whether to leave funds on the platform, and counterparties use it to decide whether to keep trading with the firm. A statement that proves premature can therefore do more damage to trust than the original loss.
Security teams usually define containment as the point at which the attacker's access has been revoked, compromised credentials rotated and affected systems isolated. Reaching that point in the middle of an active theft is difficult, particularly when the attacker holds access to several layers of the infrastructure. Companies sometimes announce containment based on the steps they have taken, before the on-chain activity has actually stopped.
The timeline set out by Bitquery does not establish why the draining continued after 12:56 UTC. It may reflect automated scripts that kept running, access that had not yet been closed, or something else. What the data does show is that transfers from customer deposit addresses were still taking place until 16:56 UTC.
For Brazilian users, the episode adds weight to the exchange's commitment to cover all losses. For the wider industry, it is a reminder that the first hours of an incident response are the hardest to get right, and that public statements made during that window may later be measured against the blockchain record.
7. What is the status of Mercado Bitcoin's services?
Mercado Bitcoin suspended deposits and withdrawals after the attack. The exchange plans to bring its website back in view-only mode on November 9, which would let customers see their accounts without being able to move funds. It has not set a date for restoring deposits or withdrawals.
A suspension of that length is a significant cost for an exchange, since trading volume and fee income depend on customers being able to fund accounts and take out assets. It also tests user confidence. The pledge to cover losses is intended to address the immediate concern for account holders, but a return to normal operation will depend on the exchange showing that the entry point has been closed.
The partial reopening in view-only form is a common first step after a security incident, because it restores transparency over balances while the more sensitive functions remain offline until they have been checked.
8. What to watch next
The nearest scheduled event is the planned view-only reopening of the Mercado Bitcoin website on November 9. Beyond that, the open items are an explanation of the cause from either exchange, confirmation from BitMart of the loss figure attributed to it, and a timetable for resuming deposits and withdrawals at Mercado Bitcoin.
Further tracing may also change the numbers. The total has already risen from $40 million to $48.6 million as analysts followed the funds across chains, and additional freezes by stablecoin issuers could raise the amount recovered above the $15 million reported so far.
Readers following the case should treat the BitMart connection as a preliminary link, based on on-chain analysis and an early statement from BitMart's founder, until the exchanges or independent investigators set out their conclusions.