Mercado Bitcoin Said Its Hack Was Contained, But Blockchain Data Tells a Different Story

In brief

• Bitquery says the attacker drained 36,042 Ethereum deposit addresses for nearly four hours after Mercado Bitcoin announced containment.
• The researchers tracked $48.6 million across 11 networks, above the exchange's latest estimate of $36.3 million.
• Mercado Bitcoin plans to reopen account viewing on November 9, but withdrawals and trading will remain suspended initially.

An attacker drained Mercado Bitcoin-linked deposit addresses nearly four hours after the Brazilian exchange said it had contained a security breach, new blockchain research shows.

Bitquery's analysis, updated Thursday, traces more than $48 million in stolen assets across 11 blockchains. Its findings challenge the exchange's claim that it stopped the attack quickly.

The Bitcoin exchange announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.

Those addresses held roughly $266,000, a small fraction of the total theft. But the attacker could still move those funds after the exchange’s announcement.

A customer deposit address works much like a personal receiving account for cryptocurrency. The exchange later gathers those coins into a shared online wallet, called a hot wallet, to process everyday transactions. Moving funds from a deposit address requires its private key, the secret that authorizes transfers.