New blockchain research suggests an attacker continued draining funds from Mercado Bitcoin-linked addresses for nearly four hours after the Brazilian cryptocurrency exchange said it had contained a security breach, and that the stolen total exceeds the exchange's latest estimate.
Blockchain data firm Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time on November 2. Mercado Bitcoin announced at 9:56 a.m. that day that it had quickly contained the incident. Bitquery's findings challenge the exchange's claim that it stopped the attack quickly, with transfers continuing after the announcement.
The drained addresses held roughly $266,000, a small fraction of the total theft, but they show the attacker could still move funds after the exchange's announcement. A customer deposit address works much like a personal receiving account: the exchange later gathers those coins into a shared online wallet, called a hot wallet, to process everyday transactions, and moving funds from a deposit address requires its private key.
Bitquery says the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or to a system capable of signing transactions on their behalf. "That needs a key for each address, or a way into the system that signs for them," the researchers said. They also warned that exchanges typically generate deposit keys from a single master key, meaning the attacker may still be able to access other customer addresses.
The scale of the theft is disputed. Bitquery estimates $48.6 million was stolen across 11 blockchains, while Mercado Bitcoin's latest estimate puts affected assets at about $36.3 million. The exchange's public updates have not explained the gap between its containment claim and the later transfers. Mercado Bitcoin has said it will cover user losses with its own funds.
Bitquery advises customers not to reuse old deposit addresses until the exchange confirms they are safe. Mercado Bitcoin plans to reopen account viewing on November 9; deposits, withdrawals and trading have no restart date.
Analysis
Why This Matters
- The size of the theft is in dispute: Bitquery's $48.6 million estimate exceeds Mercado Bitcoin's $36.3 million figure, and the exchange has not explained the gap.
- Transfers that continued for nearly four hours after the containment announcement raise questions about how quickly the breach was actually stopped and whether other customer addresses remain exposed.
- Customers face an indefinite suspension: after account viewing resumes on November 9, deposits, withdrawals and trading have no restart date.
Background
Mercado Bitcoin is a Brazilian cryptocurrency exchange. On November 2 it said it had quickly contained a security breach, and it has said it will make customers whole with its own funds. Exchanges typically generate customer deposit keys from a single master key, so an attacker who reached the signing system could potentially reach more than the addresses already emptied, according to Bitquery.
Key Perspectives
Bitquery: says 36,042 Ethereum deposit addresses were drained between 9:27 a.m. and 1:56 p.m. Brazil time on November 2, including nearly four hours after Mercado Bitcoin's containment announcement, and estimates $48.6 million was stolen across 11 blockchains.
Mercado Bitcoin: says it quickly contained the incident, puts affected assets at about $36.3 million, and says it will cover user losses with its own funds.
What to Watch
- Whether the exchange explains the gap between its containment claim and the later transfers, which its public updates have not addressed.
- November 9, when Mercado Bitcoin's account viewing reopens, and whether it then sets dates for restoring deposits, withdrawals and trading.
- Whether other customer addresses are affected, given Bitquery's warning that deposit keys derived from a single master key could put more funds at risk.
Checked
11 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe attacker moved funds from Mercado Bitcoin-linked addresses after the exchange said it had contained the breach.Decrypt: “An attacker drained Mercado Bitcoin-linked deposit addresses nearly four hours after the Brazilian exchange said it had contained a security breach, new blockchain research shows.”
- SupportedBitquery puts the stolen total at $48.6 million across 11 blockchains, above Mercado Bitcoin’s latest estimate of $36.3 million.Decrypt: “Bitquery estimates that $48.6 million was stolen across 11 blockchains. Mercado Bitcoin's now puts affected assets at about $36.3 million.”
- SupportedBitquery says 36,042 Ethereum customer deposit addresses were emptied from 9:27 a.m. to 1:56 p.m. Brazil time on November 2.Decrypt: “Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.”
- SupportedMercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident.Decrypt: “The Bitcoin exchange at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident.”
- SupportedThe emptied addresses held roughly $266,000.Decrypt: “Those addresses held roughly $266,000, a small fraction of the total theft.”
- SupportedThe researchers said, “That needs a key for each address, or a way into the system that signs for them.”Decrypt: ““That needs a key for each address, or a way into the system that signs for them,” the researchers.”
- SupportedBitquery says withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or a system that could sign transactions for them.Decrypt: “Bitquery says the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or to a system capable of signing transactions on their behalf.”
- SupportedThe researchers warned that exchanges typically generate deposit keys from one master key, so the attacker may still be able to access other customer addresses.Decrypt: “They warned that exchanges typically generate deposit keys from a single master key, meaning the attacker may still be able to access other customer addresses.”
- SupportedMercado Bitcoin’s public updates have not explained the gap between its containment claim and the later transfers.Decrypt: “Mercado Bitcoin's public updates have not explained the gap between its containment claim and the later transfers.”
- SupportedMercado Bitcoin has said it will cover user losses with its own funds.Decrypt: “The company customers it would cover user losses with its own funds.”
- SupportedMercado Bitcoin plans to reopen account viewing on November 9, while deposits, withdrawals and trading have no restart date.Decrypt: “Mercado Bitcoin's begins November 9 with balance viewing only; deposits, withdrawals and trading have no restart date.”
