Mercado Bitcoin Attackers Move Stolen Funds Hours After Containment Claim

TL;DR

• Attack Timeline: Blockchain data shows attackers continued to drain funds from thousands of customer deposit addresses for roughly four hours after Mercado Bitcoin stated the breach had been contained.
• Losses and Response: Investigators tracked $48.6 million in stolen assets across 10 blockchains, Mercado Bitcoin pledged to cover user losses.
• Potential Link: Researchers identified wallet activity that may connect the incident to a separate BitMart breach, suggesting the possibility of shared infrastructure exposure affecting multiple exchanges.
  

  ---

Hackers continued moving funds from Brazilian crypto exchange Mercado Bitcoin for hours after the platform announced it had contained a cyberattack, according to new blockchain analysis from Bitquery. The findings suggest the breach remained active longer than initially indicated and raise fresh questions about the scope of the incident affecting the exchange.

Bitquery data shows an attacker drained 36,042 customer deposit addresses on Ethereum between 12:27 UTC and 16:56 UTC on Nov. 2. During that period, the exchange issued a statement at 12:56 UTC saying the breach had been contained. The timeline has drawn attention because the unauthorized transfers continued well after the exchange’s public update. Bitquery said the pattern suggests the attacker may have gained access to systems involved in managing customer deposits at Mercado Bitcoin.

Investigation Points to Larger Losses

According to Bitquery’s investigation, the total amount stolen reached approximately $48.6 million across 10 different blockchains. That figure exceeds the previously reported estimate of $40 million. Despite the scale of the incident, Mercado Bitcoin has pledged to reimburse users for losses resulting from the breach. The company has also received support from industry partners, including Tether, Circle and Chainalysis.

Those efforts have already produced some results. More than $15 million tied to the attack has been frozen, limiting the movement of part of the stolen assets. Even so, the updated figures highlight the significant impact of the breach on Mercado Bitcoin and its customers.

Possible Connection to BitMart Incident

Bitquery’s investigation also uncovered activity that may connect the attack on Mercado Bitcoin to a separate breach involving wallets believed to belong to crypto exchange BitMart. Researchers found that the same attacker-controlled address began receiving funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin breach took place.

Bitquery estimated losses linked to those wallets at roughly $391,000, though BitMart has not confirmed that amount. BitMart founder Sheldon Xia said the exchange was hacked on Nov. 2 and that preliminary findings point to the same group behind the Mercado Bitcoin incident.

The overlap has raised the possibility that infrastructure used by multiple exchanges may have been compromised. Following the attack, Mercado Bitcoin suspended deposits and withdrawals. The exchange plans to reopen its website in view-only mode on Nov. 9, though Mercado Bitcoin has not announced a date for restoring deposit and withdrawal services.