Mercado Bitcoin’s claim that the cyberattack on its platform had been contained contradicts blockchain transaction data. The Brazilian crypto exchange announced the containment of the attack on November 2, 2026, at 9:56 AM Brazilian time, but on-chain data proves that perpetrators continued freely draining tens of thousands of customer deposit addresses for nearly four hours afterward.
On-chain forensics firm Bitquery found that 36,042 customer Ethereum deposit addresses were drained between 9:27 AM and 1:56 PM local time. From the tens of thousands of addresses emptied after the exchange’s announcement, the attacker transferred around $266,000. While this is a small fraction of the total lost assets, the fact that the hacker was still free to withdraw balances undermines the exchange’s claims of swift containment.
Bitquery’s report also updated the estimated losses suffered by the exchange. The value of stolen assets is now tracked at over $48.6 million across 11 blockchain networks, up from an initial estimate of around $46 million.
Suspected Private Key Access and Compromised Signing System
Bitquery’s technical investigation revealed that post-announcement withdrawals were authorized directly by the respective deposit addresses. This authorization pattern suggests two possibilities: the attacker gained control of each address’s private keys, or infiltrated Mercado Bitcoin’s transaction signing service.
The risk facing the exchange could be broader than the funds already transferred. Crypto exchanges typically generate deposit addresses derived from a single master key. Bitquery warned that this derivation scheme leaves open the possibility that the hacker may still retain access to other customer addresses that have not yet been touched by withdrawals.
Internal Treasury Reimbursement and Warnings Over Old Addresses
Facing tens of millions of dollars in losses, Mercado Bitcoin’s management pledged to cover all lost customer funds using the company’s internal treasury. The exchange plans a phased reopening of accounts starting November 9, 2026. However, this initial phase will only allow users to check their account balances, with no confirmed date for the reopening of deposits, withdrawals, or trading.
Given the unresolved risk of compromised keys, customers face direct security consequences for their deposit wallets. Bitquery warned users not to reuse old deposit addresses until Mercado Bitcoin issues full security verification of its address generation system.
Reported via Decrypt.
Previously: Hacked for $46 Million, Mercado Bitcoin to Reopen Accounts Monday - Losses Covered by Company Reserves
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
