In brief
- Bitquery says the attacker drained 36,042 Ethereum deposit addresses over nearly four hours after Mercado Bitcoin announced it had contained the breach.
- The researchers tracked about $48.6 million in stolen assets across 11 networks, exceeding the exchange’s latest estimate of about $36.3 million.
- Mercado Bitcoin plans to restore account viewing on Nov. 9, but withdrawals and trading will remain suspended initially.
New blockchain research indicates that an attacker drained customer deposit addresses linked to Mercado Bitcoin nearly four hours after the Brazilian exchange said it had contained a security breach.
Updated Thursday, Bitquery’s analysis traced more than $48 million in stolen assets across 11 blockchains, challenging the exchange’s claim that it had stopped the attack quickly.
Mercado Bitcoin announced at 9:56 a.m. Brazil time on Nov. 2 that it had quickly contained the incident. Bitquery said 36,042 Ethereum customer deposit addresses were drained between 9:27 a.m. and 1:56 p.m. that day.
Those addresses held roughly $266,000, a small fraction of the total theft. The attacker could still move those funds after the exchange’s announcement.
A customer deposit address works much like a personal receiving account for cryptocurrency. The exchange later gathers those coins into a shared online wallet, called a hot wallet, to process everyday transactions. Moving funds from a deposit address requires its private key, the secret that authorizes transfers.
Bitquery says the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or to a system capable of signing transactions on their behalf.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained. They warned that exchanges typically generate deposit keys from a single master key, meaning the attacker may still be able to access other customer addresses.
The amount stolen is also disputed. Initial estimates put the loss above $40 million, while Mercado Bitcoin’s updated FAQ now puts affected assets at about $36.3 million. Bitquery estimates that $48.6 million was stolen across 11 blockchains.
Mercado Bitcoin’s public updates have not explained the gap between its containment claim and later transfers. The company said it would cover user losses with its own funds.
Bitquery warns customers against reusing old deposit addresses until the exchange confirms they are safe. Mercado Bitcoin’s reopening plan begins Nov. 9 with balance viewing only; deposits, withdrawals and trading have no restart date.
