Original publication: November 6, 2026, at 04:16:03 UTC+8.
Blockchain research cited by Decrypt indicates that Mercado Bitcoin-linked deposit addresses continued to be drained nearly four hours after the Brazilian exchange said it had contained a security breach. Bitquery’s analysis, updated Thursday, estimated that $48.6 million was stolen across 11 blockchains, challenging the exchange’s account of how quickly the attack was stopped.
Transfers continued after the announcement
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. According to Bitquery, however, 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
Those addresses held roughly $266,000—a small share of the estimated total theft. Their significance was the timing: the attacker could still move funds after the exchange’s containment announcement.
The signing system is the key trust boundary
Customer deposit addresses receive cryptocurrency before an exchange gathers those funds into a shared hot wallet for everyday transactions. Transfers from a deposit address require authorization using its private key.
Bitquery said the withdrawals were authorized directly by the deposit addresses. That suggests the attacker had access either to their private keys or to a system capable of signing transactions for them; it does not establish which route was used.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained.
The researchers also warned that exchanges typically generate deposit keys from a single master key, raising the possibility that other customer addresses could remain accessible to the attacker. Bitquery advised customers not to reuse old deposit addresses until Mercado Bitcoin confirms they are safe.
Although the analysis spans 11 blockchains, the supplied report does not identify a bridge exploit or explain how assets moved between chains. Its specific finding concerns authorization of transfers from exchange-linked deposit addresses.
Loss estimates and reopening remain unresolved
The reported loss figures differ:
- Initial estimates put the theft above $40 million.
- Mercado Bitcoin’s updated FAQ put affected assets at about $36.3 million.
- Bitquery estimated $48.6 million stolen across 11 blockchains.
At the time of the report, Mercado Bitcoin’s public updates had not explained the gap between its containment claim and the later transfers. The exchange said it would cover customer losses with its own funds.
Its reopening plan was scheduled to begin on November 9 with balance viewing only. No restart date had been provided for deposits, withdrawals or trading.
