Mercado Bitcoin said it had quickly contained a security breach on November 2. But blockchain research from Bitquery says funds continued leaving exchange-linked customer deposit addresses for nearly four hours after that announcement—a gap the Brazilian exchange’s public updates had not explained.
Historical report: The original article was published November 6, 2026, at 04:16:03 UTC+8. The findings and reopening plans below reflect that reporting date.
The timeline behind the dispute
The exchange announced containment at 9:56 a.m. Brazil time on November 2. According to Bitquery’s analysis, updated Thursday, 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
Those addresses held roughly $266,000, only a small portion of the reported theft. Their significance is the timing: Bitquery says the attacker could still move those funds after the exchange said the incident was contained.
What the transfers suggest—and what remains uncertain
Customer deposit addresses receive cryptocurrency before an exchange gathers it into a shared online wallet, or hot wallet, for everyday transactions. Moving funds from a deposit address requires authorization using its private key.
Bitquery says the withdrawals were authorized directly by the deposit addresses. That suggests access either to their private keys or to a system able to sign transactions for them; it does not establish which route the attacker used.
“That needs a key for each address, or a way into the system that signs for them,” the researchers said.
The researchers also warned that exchanges typically generate deposit keys from a single master key. On that basis, they said the attacker may still be able to access other customer addresses. That is a warning about possible exposure, not confirmation that every address was compromised.
Three different loss figures
The reported total also remained unresolved:
- Initial estimates: more than $40 million.
- Mercado Bitcoin’s updated FAQ: about $36.3 million in affected assets.
- Bitquery’s estimate: $48.6 million stolen across 11 blockchains.
The exchange assured customers that it would cover user losses with its own funds. That assurance is separate from the unanswered question of why transfers continued after its containment announcement.
Bitquery warned customers against reusing old deposit addresses until the exchange confirmed they were safe. At the time of the report, Mercado Bitcoin’s reopening plan was scheduled to begin November 9 with balance viewing only. Deposits, withdrawals and trading had no restart date.