New Blockchain Analysis Challenges Mercado Bitcoin’s Containment Timeline After Multi-Million Dollar Exploit

New blockchain research has cast doubt on the official narrative surrounding a major security breach at Mercado Bitcoin, revealing that funds continued to be drained from customer-linked deposit addresses nearly four hours after the prominent Brazilian cryptocurrency exchange publicly announced it had contained the incident.

The findings, published by blockchain analytics firm Bitquery, trace more than $48 million in stolen digital assets across 11 distinct blockchains. This comprehensive investigation directly challenges assurances from Mercado Bitcoin management that the platform had moved swiftly to isolate and neutralize the threat during the early hours of the November cyberattack.

According to official communications from the exchange, Mercado Bitcoin issued a public statement at 9:56 a.m. Brazil time on November 2, asserting that it had successfully contained the security breach. However, Bitquery’s updated analysis tells a different story. The firm’s researchers documented that thousands of customer deposit addresses continued to be systematically emptied long after that announcement was made. Specifically, 36,042 Ethereum customer deposit addresses were drained between 9:27 a.m. and 1:56 p.m. Brazil time, meaning unauthorized withdrawals persisted for hours after the exchange claimed the situation was under control.

While those specific Ethereum addresses held roughly $266,000—representing a small fraction of the total losses incurred during the broader exploit—the ability of the attacker to continue moving funds long after the exchange’s containment declaration has raised serious questions about system visibility, internal response times, and the true extent of the compromise.

To understand the mechanics of the breach, it is helpful to examine how centralized cryptocurrency exchanges handle customer funds. A customer deposit address functions similarly to a personal receiving account dedicated to an individual user on a specific platform. Once digital assets arrive at these individual addresses, the exchange typically consolidates the coins into a shared, highly secure online repository known as a hot wallet, which is used to process everyday trading and withdrawal transactions efficiently.

Moving funds directly out of an individual deposit address requires the corresponding private key—the cryptographic secret that authorizes transfers and proves ownership. Bitquery’s investigation indicates that the post-containment withdrawals were authorized directly by

the deposit addresses themselves. This technical detail suggests that the malicious actor either managed to obtain the private keys for those individual addresses or gained unauthorized access to an internal exchange system capable of cryptographically signing transactions on their behalf.

The implications of this finding extend beyond the immediate financial losses. As Bitquery researchers noted, cryptocurrency exchanges typically generate large batches of customer deposit keys derived from a single master key or a centralized key management system. If an attacker gains access to the underlying infrastructure or key generation mechanisms, the risk is not limited to the addresses already exploited; it opens up the possibility that other customer addresses could remain vulnerable until comprehensive security overhauls and key rotations are completed.

Beyond the timeline discrepancies, the total financial damage of the Mercado Bitcoin incident remains a subject of varying estimates. Initial reports following the halt of platform operations placed the stolen amount above $40 million. In subsequent updates, Mercado Bitcoin’s revised frequently asked questions page adjusted the figure, estimating the affected assets at approximately $36.3 million. Meanwhile, Bitquery’s exhaustive cross-chain tracking paints a larger picture, calculating that approximately $48.6 million was siphoned across 11 different blockchain networks.

Despite the growing body of on-chain data, Mercado Bitcoin has not yet provided public explanations addressing the gap between its initial containment claims and the subsequent transfers detected by blockchain sleuths. Nevertheless, the exchange has taken responsibility for the incident from a customer protection standpoint, repeatedly assuring its user base that it possesses the financial capacity to cover all user losses entirely out of its own corporate reserves.

As the investigation continues, industry observers and security experts are urging caution among the exchange’s users. Bitquery has explicitly warned customers against reusing any previously assigned deposit addresses until Mercado Bitcoin conducts a thorough security audit and formally confirms that those specific endpoints are entirely safe for future transactions.

Mercado Bitcoin has outlined a phased reopening plan for its platform, scheduled to begin on November 9. Initially, the system will restore basic balance-viewing capabilities for users. However, critical functions such as cryptocurrency deposits, standard withdrawals, and active market trading remain offline, with no definitive restart date announced as the exchange works to rebuild its compromised infrastructure and restore full operational security.