Mercado Bitcoin Breach Questions Deepen After Containment Claim
Mercado Bitcoin faces further questions over the timeline of its response to a Nov. 2 security breach after blockchain analysis indicated that customer deposit addresses continued to be drained after the exchange said the incident had been contained.
CoinDesk reported that the activity involved 36,042 customer deposit addresses on Ethereum and that the same attacker later received roughly $391,000 from wallets Bitquery linked largely to BitMart. The reports do not establish that the two exchanges were compromised through the same method.
What happened
According to CoinDesk, Bitquery identified continued draining of Mercado Bitcoin customer deposit addresses on Ethereum after Mercado Bitcoin communicated on Nov. 2 that the breach had been contained. The analysis covered 36,042 deposit addresses, raising a distinction between announcing containment and regaining operational control over all affected deposit infrastructure.
Mercado Bitcoin suspended deposits and withdrawals following the attack, CoinDesk reported. The exchange plans to reopen its website in view-only mode on Nov. 9, but it has not provided a date for the return of deposits or withdrawals.
The reported scope of stolen assets has changed as investigators traced activity across more networks. FinanceFeeds reported that Bitquery traced $48.6 million in stolen assets across 10 blockchains, higher than the $40 million figure first reported. The total remains unsettled: Mercado Bitcoin stated a $36.3 million loss on Nov. 3, while Chainalysis put the amount at about $49 million, according to figures cited in the available reporting.
CoinDesk also reported that more than $15 million connected to the attack was frozen or blocked with assistance from Tether, Circle and Chainalysis. Mercado Bitcoin has pledged to cover all user losses, making the eventual recovery process dependent both on blocked assets and on the exchange’s own commitment.
A separate flow identified by Bitquery has added to scrutiny around the incident. CoinDesk reported that the same attacker took about $391,000, mostly from wallets Bitquery tied to BitMart. CryptoNews said an attacker-controlled address received the funds from wallets on Base, Arbitrum and Optimism, beginning 53 minutes before Mercado Bitcoin-related funds moved.
BitMart founder Sheldon Xia said in a Nov. 3 post on X that BitMart was hacked on Nov. 2, CryptoNews reported. Xia described the amount as small and said a preliminary investigation pointed to the group behind the Mercado Bitcoin attack. He also said BitMart’s security team was severely understaffed during restructuring.
Why it matters
The continuing drain reported by CoinDesk is significant because crypto exchange deposit systems often use many addresses across blockchain networks. A public declaration that an event is contained can be understood as a statement about the status of an incident response, but the reported movement from thousands of addresses indicates that investigators and customers will closely examine what systems remained exposed at that point.
The gap between the loss estimates is also important. The figures range from Mercado Bitcoin’s $36.3 million statement to Bitquery’s $48.6 million cross-chain tracing estimate and Chainalysis’s estimate of about $49 million. These amounts may reflect different tracing methodologies, different cut-off times or differing definitions of assets linked to the incident, but no single final total is established in the reporting.
The $391,000 linked by Bitquery to BitMart adds another unresolved dimension. CryptoNews reported Xia’s preliminary assessment of a connection, but Bitquery says BitMart has not confirmed ownership of the specific wallets involved or the $391,000 figure. That leaves the reported overlap as an investigative lead rather than a confirmed technical attribution.
Background and context
Mercado Bitcoin is Brazil’s largest crypto exchange. For an exchange of that scale, the reported continued draining of deposit addresses after a containment announcement puts attention on the timing of its recovery of customer-deposit infrastructure and on the safeguards used across supported blockchain networks.
The reported shared receiving address involving wallets linked by Bitquery to BitMart raises the possibility that common infrastructure or methods affected more than one exchange. Available reports have not confirmed that conclusion. Xia’s statement described a preliminary investigation, while Bitquery has said BitMart did not confirm that the wallets identified in its analysis belonged to the exchange.
The role of Tether and Circle is also notable because the issuers can freeze certain tokens under their control. CoinDesk reported that assistance from those firms and Chainalysis helped freeze or block more than $15 million. The extent to which those actions translate into recoverable value for affected customers has not been detailed.
Mercado Bitcoin’s pledge to cover user losses remains central to the customer impact. Its planned view-only reopening would allow users to access the website, but it would not restore the ability to deposit or withdraw assets.
What to watch
Further disclosures may clarify why the deposit-address activity identified by Bitquery continued after Mercado Bitcoin’s containment statement, including whether the activity resulted from remaining access to exchange systems, pre-existing transaction authorization or another mechanism.
It will also be important to watch whether Mercado Bitcoin provides a final loss calculation, a timetable for restoring deposits and withdrawals, and details on how it will implement its commitment to cover losses. The current reporting establishes a planned Nov. 9 view-only reopening, not a full resumption of services.
Another open question is whether BitMart or independent investigators confirm the ownership of the wallets Bitquery associated with the $391,000 transfer. Such confirmation would help determine whether the reported activity represents a direct connection between the incidents or only an address-level association.
