Original report published November 6, 2026, at 04:16:03 UTC+8.
Blockchain research from Bitquery challenges Mercado Bitcoin’s account of how quickly it contained a security breach. According to the analysis, an attacker continued draining deposit addresses linked to the Brazilian exchange nearly four hours after its public containment announcement.
The findings raise questions about control of customer deposit keys. They also leave an unresolved gap between the exchange’s estimate of affected assets and Bitquery’s calculation of the theft.
Deposit addresses remained accessible to the attacker
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery’s analysis, updated Thursday, says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
Those addresses held roughly $266,000, only a small share of the total reported theft. The significance is the timing: according to Bitquery, the attacker could still transfer funds from them after the exchange said the incident was contained.
A customer deposit address receives cryptocurrency before the exchange gathers it into a shared online wallet, or hot wallet, for routine transactions. Moving assets out of a deposit address requires authorization through its private key.
Bitquery says the withdrawals were authorized directly by the deposit addresses, suggesting that the attacker had access either to their private keys or to a system able to sign transactions for them.
“That needs a key for each address, or a way into the system that signs for them,” the researchers said.
The researchers warned that exchanges typically generate deposit keys from a single master key, raising the possibility that other customer addresses could remain accessible to the attacker. The supplied findings do not establish which access route was used.
Theft estimates differ; reimbursement remains an exchange commitment
The reported loss figures remain disputed:
- Initial estimates put the theft at more than $40 million.
- Mercado Bitcoin’s updated FAQ puts affected assets at about $36.3 million.
- Bitquery estimates $48.6 million was stolen across 11 blockchains.
Mercado Bitcoin’s public updates had not explained the gap between its containment statement and the later transfers. The company assured customers that it would cover user losses with its own funds; that is a reimbursement commitment, not confirmation that customers had already been repaid.
Bitquery warned customers against reusing old deposit addresses until the exchange confirms they are safe.
As described in the original report, Mercado Bitcoin’s reopening plan was scheduled to begin November 9 with balance viewing only. No restart date had been set for deposits, withdrawals or trading.