Blockchain Data Contradicts Mercado Bitcoin's Containment Claim

Brazilian exchange Mercado Bitcoin kept losing customer funds for nearly four hours after it publicly declared a security breach contained, according to on-chain analysis by blockchain analytics firm Bitquery published Thursday.

The exchange announced containment at 9:56 a.m. Brazil time on November 2. Bitquery's data shows an attacker emptied 36,042 Ethereum customer deposit addresses between 9:27 a.m. and 1:56 p.m. — meaning withdrawals were still being authorized roughly four hours after the containment statement.

Those Ethereum addresses held only about $266,000, a small slice of the theft. The operational detail matters more than the amount: moving funds from a deposit address requires its private key, and Bitquery found the transfers were signed directly by the deposit addresses themselves.

"That needs a key for each address, or a way into the system that signs for them," the researchers explained. Exchanges typically derive deposit keys from a single master key, so the attacker may hold the ability to drain other customer addresses that haven't been touched yet. That's the scenario Bitquery flagged as the live risk.

How big is the theft, really?

The numbers don't agree, and the gap is wide. Bitquery estimates $48.6 million in stolen assets traced across 11 blockchains. Mercado Bitcoin's updated customer FAQ puts affected assets at about $36.3 million. Early estimates circulated above $40 million.

Bitquery's figure sits more than $12 million above the exchange's own accounting. Mercado Bitcoin has not publicly explained the discrepancy, nor has it addressed the contradiction between its 9:56 a.m. containment claim and the transfers Bitquery recorded into the early afternoon.

The company has told customers it will cover user losses from its own funds — a commitment that now depends on how large the final number grows.

What happens to customers now?

Mercado Bitcoin's recovery timetable is deliberately narrow. Account balance viewing reopens November 9. Deposits, withdrawals and trading have no restart date at all, and the exchange hasn't said when those functions might come back online.

Bitquery's warning to customers is blunt: don't reuse old deposit addresses until the exchange confirms they're safe. If the attacker compromised a master key or the signing system, any funds sent to a legacy deposit address could be swept the same way the November 2 batch was.

The mechanics of the breach point to a key-management failure rather than a smart-contract exploit. A deposit address functions like a personal receiving account; the exchange later sweeps coins into a shared hot wallet for daily operations. Someone authorized transfers from tens of thousands of those addresses in a single morning, which suggests either mass key compromise or access to the infrastructure that signs on customers' behalf.

For an exchange operating at Mercado Bitcoin's scale in Brazil's regulated market, that distinction shapes everything downstream: what gets rebuilt, what keys get rotated and how quickly regulators in Brasília ask for an explanation.

Until the exchange publishes its own forensic timeline or confirms key rotation, the practical deadline for customers is structural — the November 9 balance-viewing reopen arrives with trading and withdrawals still dark, and no announced date for either.