Blockchain analysis by Bitquery indicates that an attacker continued draining Mercado Bitcoin-linked customer deposit addresses for nearly four hours after the Brazilian exchange said it had contained a security breach.
According to Decrypt’s report, published November 6, 2026, at 04:16:03 UTC+8, Bitquery estimated that $48.6 million was stolen across 11 blockchains—more than the roughly $36.3 million in affected assets reported in the exchange’s updated FAQ.
Transfers continued after the announcement
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery’s analysis, updated Thursday, found that 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
Those addresses held approximately $266,000, a small share of the total estimated theft. However, the transfers indicate that the attacker could still move funds after the exchange’s containment announcement.
What the deposit-address activity suggests
Customer deposit addresses receive cryptocurrency before an exchange gathers the funds into a shared online wallet, or hot wallet, for everyday transactions. Transferring funds from a deposit address requires authorization using its private key.
Bitquery said the withdrawals were authorized directly by the deposit addresses, suggesting that the attacker had access either to their private keys or to a system able to sign transactions on their behalf.
“That needs a key for each address, or a way into the system that signs for them,” the researchers explained.
The researchers warned that exchanges typically generate deposit keys from a single master key. On that basis, they said the attacker might still be able to access other customer addresses. This remained a potential risk, not a confirmed finding that additional addresses had been compromised.
Loss estimates and service restoration remain unresolved
Initial estimates placed the theft above $40 million. Mercado Bitcoin’s updated FAQ put affected assets at about $36.3 million, while Bitquery’s estimate reached $48.6 million across 11 blockchains.
At the time of the report, Mercado Bitcoin’s public updates had not explained the gap between its containment statement and the subsequent transfers. The exchange assured customers that it would cover user losses with its own funds.
Bitquery warned customers against reusing old deposit addresses until the exchange confirmed they were safe. Mercado Bitcoin’s reopening plan was scheduled to begin November 9 with balance viewing only; deposits, withdrawals and trading had no announced restart date.