SMS
- Bitquery stated that, even after Mercado Bitcoin announced it had contained the security incident, attackers continued to transfer funds from 36,042 Ethereum deposit addresses over nearly four hours.
- Researchers traced $48.6 million in assets across 11 networks, exceeding the exchange's latest estimate of $36.3 million.
- Mercado Bitcoin plans to restore account viewing functionality on November 9, but withdrawals and trading will remain suspended initially.
New on-chain research shows that, even after the Brazilian exchange Mercado Bitcoin claimed to have contained a security vulnerability, attackers continued to transfer funds from deposit addresses associated with the exchange for nearly four hours.
Bitquery’s Thursday update showed that assets stolen across 11 blockchains exceeded $48 million, challenging the exchange’s claim that it swiftly thwarted the attack.
The Bitcoin exchange announced at 9:56 AM Brazil Time on November 2 that it had quickly contained the incident. According to Bitquery, a total of 36,042 Ethereum customer deposit addresses were emptied between 9:27 AM and 1:56 PM Brazil Time.
These addresses hold approximately $266,000, representing only a small portion of the total loss. However, even after the exchange issued its announcement, the attacker can still transfer these funds.
A customer deposit address functions similarly to a personal receiving account for cryptocurrency. The exchange then aggregates these coins into a shared online wallet, known as a hot wallet, to handle daily transactions. Transferring funds from a deposit address requires its private key—the secret credential that authorizes the transfer.
Bitquery stated that these withdrawals were authorized directly from the deposit addresses, indicating that the attacker may have gained access to the private keys of these addresses or obtained system permissions allowing them to sign transactions on behalf of these addresses.
Researchers explained, "This requires each address to have its own key or access to a system that signs for these addresses." They warned that exchanges typically generate deposit keys from a single master key, meaning attackers could still access other customer addresses.
The amount stolen is also disputed. Initial estimates suggested losses exceeding $40 million, while Mercado Bitcoin’s latest FAQ page lists the affected assets at approximately $36.3 million. Bitquery estimates the total stolen across 11 blockchains at $48.6 million.
Mercado Bitcoin's public update did not explain the discrepancy between its claim of having "contained" the issue and subsequent transfers. The company assured customers that it would cover user losses using its own funds.
Bitquery warns customers not to reuse old deposit addresses until the exchange confirms they are secure. Mercado Bitcoin’s recovery plan begins on November 9, initially allowing only balance viewing; deposits, withdrawals, and trading have no scheduled restart date.