Mercado Bitcoin told the public its breach was contained at 12:56 UTC on November 2. A new report from blockchain analytics firm Bitquery says the attacker kept draining customer deposit addresses for roughly four more hours after that statement, and the total stolen has climbed from the $40 million first reported to $48.6 million spread across 10 blockchains.
The containment claim didn’t match the blockchain
Brazil’s largest crypto exchange went dark on November 2, when word spread that an attacker had broken into its systems and started draining customer funds. We covered the first wave of that story when Mercado Bitcoin halted withdrawals after roughly $40 million vanished across ten blockchains. At the time, the exchange said the situation was under control.
Bitquery’s new timeline complicates that account. The firm says the attacker drained 36,042 customer deposit addresses on Ethereum between 12:27 and 16:56 UTC on November 2. Mercado Bitcoin posted its containment statement at 12:56 UTC, less than half an hour into that window. By Bitquery’s reading of the on-chain data, the theft kept running for close to four more hours after the company told everyone it had stopped.
That gap is the real story here. It is one thing for an exchange to get hit and lose money before anyone notices. It is another to announce the bleeding has stopped while the attacker is still moving funds out the door. Bitquery says the pattern it traced on Ethereum “suggests the hacker gained access to systems used to manage customer deposits,” which would explain why a public containment statement did nothing to stop the outflow in real time.
This isn’t the first time an exchange’s early statement has turned out to understate what was actually happening underneath it. The first hours of a breach are chaotic for whoever is trying to contain it, and the instinct to reassure customers and markets tends to get ahead of what the forensics team actually knows at that moment. The problem is that the gap between reassurance and reality is exactly what erodes trust once outside researchers publish a more complete picture days later, which is what just happened here.
The total is bigger, and so are the freezes
The dollar figure has moved too. Bitquery traced $48.6 million in stolen assets across ten blockchains, above the $40 million first reported in the days right after the hack. The Ethereum deposit addresses alone accounted for roughly $266,000 of that total, with the rest spread across the other nine chains Mercado Bitcoin operates on.
The recovery side has grown as well. Tether froze $4.5 million worth of USDT in the immediate aftermath, but Bitquery now says Tether, Circle, and Chainalysis have worked together to freeze more than $15 million tied to the stolen funds. That is still less than a third of what Bitquery says actually left the exchange, which gives some sense of how much ground stablecoin issuers and analytics firms can realistically cover once funds start moving through mixers and cross-chain bridges.
Mercado Bitcoin has already pledged to cover every customer’s losses out of its own balance sheet, regardless of what gets recovered or frozen. That is the right call for customer trust, but a $48.6 million hole is a different financial problem than a $40 million one, and the exchange has not said anything publicly since Bitquery’s report went out.
A possible link to a second exchange
The part of this report most worth watching is the connection to BitMart. Bitquery says the same attacker-controlled address was receiving funds from wallets on Base, Arbitrum, and Optimism before the Mercado Bitcoin breach even started, and it ties roughly $391,000 in losses on those chains mostly to wallets it links to BitMart.
BitMart founder Sheldon Xia said on X that BitMart was hacked on November 2 as well, and that his team’s preliminary investigation points to the same group behind the Mercado Bitcoin attack. BitMart has not confirmed Bitquery’s specific dollar figure, and nobody has named the attacker. Bitquery is careful to call this an overlap that “raises the possibility” of shared infrastructure access across exchanges, not a confirmed finding. Still, two exchanges hit by what looks like the same actor within the same window is the kind of detail that tends to get more interesting as more forensic firms start pulling the same wallet addresses.
If two unrelated exchanges really were hit by the same actor in the same narrow window, that points to a shared vendor, a shared piece of infrastructure, or a social engineering campaign run in parallel against multiple targets at once, the kind of operation Binance’s own incident report described in granular detail. Forensic firms tracing wallet overlaps across different exchanges is becoming one of the more reliable ways to spot a multi-target campaign before any of the victims say so publicly, and it is worth watching whether other exchanges quietly confirm similar activity in the coming days.
It is a smaller, messier echo of what we saw play out with Binance’s own incident report on its $6.3 billion hack, where the full attack chain only became clear once the exchange published its own detailed account weeks later. Mercado Bitcoin has not done that yet, and right now an outside analytics firm is the one filling in the timeline instead of the company itself.
What happens next for Mercado Bitcoin customers
Deposits and withdrawals remain suspended. Mercado Bitcoin says it will bring its website back in view-only mode on November 9, with no date yet for when customers will be able to move money again. For a platform that bills itself as Brazil’s largest crypto exchange, a week-plus of frozen accounts is already a serious hit to user confidence, and a report showing the breach ran longer than disclosed does not help.
No attribution has been made public. Bitquery’s report stops short of naming a group or a nation-state, which puts this well behind where the Binance investigation was at a comparable stage. What is confirmed is the scale, the timeline mismatch, and the fact that an independent analytics firm, not the exchange, produced both.
The bottom line
Companies get hacked. That part is not new, and it will keep happening to exchanges, banks, and SaaS platforms long after this story fades. What should worry Mercado Bitcoin customers more is the four-hour gap between the public all-clear and the actual all-clear. If Bitquery’s timeline holds up, the exchange either did not know its own breach was still active when it said otherwise, or it knew and said it anyway. Neither answer is reassuring, and until Mercado Bitcoin publishes its own detailed account the way Binance eventually did, outside researchers are the only ones telling customers what actually happened to their money.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
