An investigation published by blockchain intelligence firm Bitquery on Thursday (5) identified movements of funds linked to Brazilian exchange Mercado Bitcoin for approximately four hours after the company announced that it had contained a cyberattack. The analysis reconstructs transactions carried out on November 2 and points out that thousands of deposit addresses continued to be emptied after the official statement.
On the morning of the attack, at 9:56 a.m. Brasília time (12:56 UTC), Mercado Bitcoin reported that it had quickly identified and contained a security incident. However, according to Bitquery, 36,042 deposit addresses on the Ethereum network transferred their balances to addresses attributed to the attacker between 12:27 and 16:56 UTC.
The reconstruction adds a temporal dimension to the incident, initially reported through multimillion-dollar transfers from the exchange's wallets. The records show activity after the containment statement, but do not prove, in isolation, a second breach or that all of the platform's systems remained compromised.
What the addresses show after the containment statement
According to Bitquery, the first phase of the attack hit the exchange's operational wallets on ten blockchain networks, with movements concentrated within approximately 25 minutes. Hours later, the attacker began withdrawing funds from addresses used to receive deposits.
On Ethereum, the 36,042 emptied addresses contained approximately US$ 266,000. About 91% had balances below US$ 10, while only 113 held 61% of the value withdrawn from those addresses.
The analysis also identified transfers after the announcement on other networks. On BNB Chain, a wallet associated with the exchange sent approximately US$ 124,000 to the attacker by 18:08 UTC, more than five hours after the statement. On Base, another 308 deposit addresses moved about US$ 16,000 that night.
The ability to move funds directly from these addresses suggests, in Bitquery's assessment, that the attacker gained access to signing keys or to some mechanism capable of authorizing the transactions. Public data, however, do not allow determining how that access was obtained.
The number of affected addresses does not necessarily equal the number of customers harmed, since the same person may use different deposit addresses.
Estimated loss and blocked amounts
Bitquery estimates that US$ 48.6 million were withdrawn from wallets associated with Mercado Bitcoin across 11 blockchains, considering asset prices at the time of the transactions. The report presents a broader scope than the ten-network subset mentioned in CoinDesk's initial coverage, without an explicit reconciliation between the counts.
The analytics firm identified approximately US$ 11.8 million in assets frozen by five issuers, mainly Tether, Circle and Paxos. The amount differs from the US$ 11.2 million reported by the exchange on November 2, when the freezes were still in progress.
In a November 4 update, Mercado Bitcoin reported that the total blocked with support from partners already exceeded US$ 15 million. This figure has a broader recovery scope than the specific analysis of freezes by issuers.
The exchange maintains that its customers will not lose assets as a result of the incident and promised to replenish balances with its own funds. The company also stated that the diversion hit its hot wallets, used in daily operations.
The platform's resumption is scheduled to begin on November 9, initially with access through the website to check balances, statements and investments. Withdrawals, deposits and trading will depend on additional security validations, with no confirmed date for normalization.
CoinDesk reported that it had not obtained immediate comment from Mercado Bitcoin on the new investigation. The records analyzed by Bitquery document the continuation of transfers after the statement, but do not make it possible to conclude whether customers will suffer financial losses or what the current security status of the addresses involved is.
