Original report published November 6, 2026, at 04:16 UTC+8.
Blockchain research cited by Decrypt indicates that Mercado Bitcoin-linked customer deposit addresses continued to lose funds nearly four hours after the Brazilian exchange said it had contained a security breach.
Bitquery’s analysis, updated Thursday, estimated that $48.6 million was stolen across 11 blockchains. Its findings challenge the exchange’s account of how quickly the attack was stopped, while leaving important questions about access to deposit-address signing systems unresolved.
Transfers continued after the announcement
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. According to Bitquery, however, 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
Those addresses held roughly $266,000—a small portion of the total reported theft. The significance was the timing: the attacker could still transfer those funds after the exchange’s containment announcement.
Mercado Bitcoin’s public updates had not explained that discrepancy, according to the report.
Why deposit-address access matters
A customer deposit address serves as a receiving account for cryptocurrency. The exchange later gathers funds from these addresses into a shared online wallet, or hot wallet, used to process everyday transactions.
Moving funds from a deposit address requires authorization using its private key. Bitquery said the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access either to their private keys or to a system able to sign transactions for them.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained.
Bitquery also warned that exchanges typically generate deposit keys from a single master key. On that basis, the researchers said the attacker might still be able to access other customer addresses; the report did not establish that such access was continuing.
Loss estimates differ; payment functions remain without a restart date
The reported loss figures remained disputed:
- Initial estimates put the theft above $40 million.
- Mercado Bitcoin’s updated FAQ put affected assets at about $36.3 million.
- Bitquery estimated $48.6 million across 11 blockchains.
Mercado Bitcoin assured customers it would cover user losses with its own funds. Bitquery warned customers against reusing old deposit addresses until the exchange confirmed they were safe.
At the time of the report, the exchange’s reopening plan was scheduled to begin November 9 with balance viewing only. Deposits, withdrawals and trading had no announced restart date. Viewing a balance therefore would not mean customers could resume moving funds or trading.