Original report published November 6, 2026, at 04:16:03 UTC+8.
Blockchain research cited by Decrypt indicates that funds continued to leave Mercado Bitcoin-linked customer deposit addresses for nearly four hours after the Brazilian exchange said it had contained a security breach.
Bitquery’s analysis, updated Thursday before the report’s publication, estimated that $48.6 million was stolen across 11 blockchains. That figure and the transfer timeline differ from the exchange’s public account.
Transfers continued after the containment announcement
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. According to Bitquery, however, 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time that day.
Those addresses held roughly $266,000, a small share of the estimated total theft. Their significance lies in the timing: the attacker was still able to move funds after the exchange’s announcement.
The address count is not a count of affected customers. The supplied reporting does not establish how many individual users those addresses represented.
What the transfers suggest about access
Customer deposit addresses receive cryptocurrency before an exchange gathers it into a shared online wallet, or hot wallet, for everyday transactions. Moving funds from a deposit address requires authorization using its private key.
Bitquery said the withdrawals were authorized directly by the deposit addresses. That suggests the attacker had access either to their private keys or to a system that could sign transactions on their behalf—not necessarily that either access route had been conclusively identified.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained.
They also warned that exchanges typically generate deposit keys from a single master key, raising the possibility that other customer addresses could remain accessible to the attacker. Bitquery cautioned customers against reusing old deposit addresses until Mercado Bitcoin confirmed they were safe.
Loss estimates and service recovery remained unresolved
The reported loss figures differed:
- Initial estimates: more than $40 million.
- Mercado Bitcoin’s updated FAQ: about $36.3 million in affected assets.
- Bitquery’s estimate: $48.6 million across 11 blockchains.
At the time of the report, Mercado Bitcoin’s public updates had not explained the gap between its containment statement and the subsequent transfers. The exchange said it would cover user losses with its own funds.
Its reopening plan was scheduled to begin November 9 with balance viewing only. No restart date had been provided for deposits, withdrawals or trading. The planned return of balance access therefore did not amount to a resumption of normal exchange services.
