Decrypt reported on November 6, 2026 that on-chain analysis by Bitquery shows an attacker continued draining Mercado Bitcoin-linked customer deposit addresses for nearly four hours after the Brazilian exchange claimed the security breach had been contained.
The exchange announced at 9:56 a.m. Brazil time on November 2, 2026 that it had quickly contained the incident. Bitquery’s analysis, updated on Thursday, traces more than $48 million in stolen assets across 11 blockchains; the firm separately estimates that $48.6 million was stolen. Its findings challenge the exchange’s statement that the attack was stopped quickly.
Bitquery identified 36,042 Ethereum customer deposit addresses emptied between 9:27 a.m. and 1:56 p.m. Brazil time on November 2. Those addresses held roughly $266,000, representing only a small fraction of the total theft. The attacker was still able to move those funds after the exchange’s containment announcement.
A customer deposit address functions similarly to a personal receiving account for cryptocurrency. The exchange subsequently aggregates those coins into a shared hot wallet used for processing routine transactions. Moving funds from any deposit address requires its private key, which authorizes the transfers.
Bitquery observed that the withdrawals were authorized directly by the deposit addresses. This indicates the attacker obtained access to the private keys themselves or to a system capable of signing transactions on their behalf. The researchers explained that this access needs a key for each address, or a way into the system that signs for them.
They warned that exchanges typically generate deposit keys from a single master key, meaning the attacker may still be able to access other customer addresses. Bitquery advised customers not to reuse old deposit addresses until the exchange confirms they are safe.
The total amount stolen remains disputed. Early estimates placed losses above $40 million. Mercado Bitcoin’s updated FAQ lists affected assets at about $36.3 million, while Bitquery’s figure stands at $48.6 million across 11 blockchains. The exchange’s public updates have not addressed the discrepancy between its containment claim and the continued transfers.
Mercado Bitcoin stated it would cover user losses using its own funds. Its reopening is scheduled to begin on November 9, 2026 with balance viewing only; no restart dates have been set for deposits, withdrawals, or trading.
