Nov 5, 2026, 5:44 a.m. EST
2 min read
Summary
- Mercado Bitcoin’s attacker kept emptying customer deposit addresses for about four hours after the exchange said the breach was contained, Bitquery found.
- The 36,042 Ethereum addresses held about $266,000. In all, Bitquery traced $48.6 million taken across 10 blockchains, above the $40 million first reported.
- The same attacker took about $391,000, mostly from wallets Bitquery ties to BitMart, whose founder confirmed a Nov. 2 hack and suspects a link.
Hackers continued draining funds from Brazilian cryptocurrency platform Mercado Bitcoin for approximately four hours subsequent to the firm’s declaration that the security incident had been neutralized, based on distributed ledger records.
The perpetrator emptied 36,042 user deposit locations on Ethereum between 12:27 and 16:56 UTC on November 2, notwithstanding the trading venue’s statement at 12:56 UTC that same day asserting the intrusion was handled, according to analytics provider Bitquery.
The discovery casts uncertainty regarding the speed at which Mercado Bitcoin managed to secure the situation and implies the malicious actor acquired entry to the platforms handling user account balances.
Mercado Bitcoin was not promptly reachable for statements.
Bitquery followed $48.6 million in pilfered capital across 10 distributed networks, surpassing the $40 million initially disclosed. The exchange promised to reimburse all consumer damages resulting from the security breach, while collaborators such as Tether, Circle, and Chainalysis assisted in locking over $15 million.
The inquiry additionally uncovered connections to a distinct exploit involving addresses suspected to appertain to digital asset platform BitMart.
The identical hacker-administered address began gathering assets from accounts on Base, Arbitrum, and Optimism prior to the Mercado Bitcoin incident. Bitquery associated approximately $391,000 in deficits with those addresses, although BitMart has not verified that exact sum. Chief Executive Officer Sheldon Xia stated that BitMart suffered a security breach on November 2 and that its initial findings indicate a connection to the syndicate behind the Mercado Bitcoin exploit.
This intersection suggests the possibility that the wrongdoer breached backend architecture shared across various trading platforms, although the root vector of the exploits remains undetermined.
Mercado Bitcoin halted inbound and outbound asset transfers following the incident and plans to relaunch its portal in a read-only state on November 9, with no schedule yet established for restoring deposits or withdrawals.
Originally published at https://www.coindesk.com/business/2026/11/05/mercado-bitcoin-hack-continued-hours-after-exchange-said-attack-was-contained-report-finds.
