Mercado Bitcoin-linked deposit addresses continued to lose funds for nearly four hours after the Brazilian exchange said it had contained a security breach, according to blockchain research from Bitquery reported by Decrypt.
The findings raise two unresolved questions: when the attacker’s access actually ended, and how much was stolen.
Transfers continued after the announcement
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2, 2026, that it had quickly contained the incident. Bitquery’s analysis, updated Thursday, says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time that day.
Those addresses held roughly $266,000—a small portion of the estimated total theft, but evidence that funds could still be moved after the exchange’s announcement.
Customer deposit addresses receive crypto before an exchange gathers it into a shared online wallet, or hot wallet, for everyday transactions. According to Bitquery, the withdrawals were authorized directly by the deposit addresses, suggesting access to their private keys or to a system able to sign transactions for them.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained.
Bitquery warned that exchanges typically generate deposit keys from a single master key. On that basis, it said the attacker might still be able to access other customer addresses; that possibility was not established as a confirmed outcome.
Loss estimates remain disputed
The reported figures differ:
- Initial estimates put the theft above $40 million.
- Mercado Bitcoin’s updated FAQ put affected assets at about $36.3 million.
- Bitquery estimated $48.6 million stolen across 11 blockchains.
At the time of the report, Mercado Bitcoin’s public updates had not explained the gap between its containment statement and the later transfers. The company said it would cover user losses with its own funds.
Bitquery advised customers not to reuse old deposit addresses until the exchange confirmed they were safe. Mercado Bitcoin’s reopening plan was scheduled to begin November 9 with balance viewing only. Deposits, withdrawals and trading had no announced restart date.
Historical reporting context: The original article was published November 6, 2026, at 04:16:03 (UTC+08:00). The reopening schedule and unresolved questions above reflect that report, not a subsequent status update.