Mercado Bitcoin hack grows to $48.6M as drain ran 4 hours past 'contained' claim
Author: Crypffalo Research · 20:56 05/11/2026
Bitquery's on-chain analysis puts the Mercado Bitcoin hack at about $48.6 million across 10 blockchains, with customer deposit addresses swept for four hours after the exchange said the breach was contained.
The hack at Brazilian exchange Mercado Bitcoin ran longer than the company first said. On-chain analysis by Bitquery, reported by CoinDesk on Nov 5, shows the attacker kept draining customer deposit addresses for about four hours after the exchange declared the breach contained.
Bitquery puts the total taken from hot wallets across 10 blockchains at roughly $48.6 million, up from the roughly $40 million first reported on Nov 2. Deposits and withdrawals remain paused, and the exchange says customers will not bear any losses.
Key takeaways
- Losses: About $48.6 million per Bitquery, valued at the time of each transfer, versus the exchange's own figure of about $38 million.
- New finding: More than 36,000 Ethereum deposit addresses were swept until 16:56 UTC on Nov 2, after a "contained" statement at 12:56 UTC.
- Frozen: Roughly $11.8 million in stablecoins and tokens blocked by issuers, according to Bitquery.
- Linked case: BitMart's founder said that exchange was also hacked on Nov 2, likely by the same group.
- Status: The website is set to reopen in view-only mode on Nov 9, with no date yet for withdrawals.
What happened on Nov 2
According to Bitquery, Mercado Bitcoin's hot wallets were drained between 06:24 and 06:50 UTC on Nov 2. The Ethereum hot wallet alone sent out more than 180 different tokens, mostly one token per transfer.
At 12:56 UTC, the exchange said the attack had been contained. On-chain data shows a second wave continued after that.
- 06:24–06:50 UTC: Hot wallets drained across 10 networks.
- 12:27–16:56 UTC: 36,042 customer deposit addresses on Ethereum swept, worth about $266,000 in total.
- 12:56 UTC: Exchange says the breach is contained.
- Nov 2 evening: Exchange says $11.2 million has been blocked.
The deposit sweep was small in value, as about 91% of the addresses held under $10. The bigger concern is Bitquery's view that the attacker can likely sign for any deposit address, since exchanges usually derive them from a single master key.
Where the funds went
Ethereum accounts for most of the losses at about $29.7 million, followed by Bitcoin at $8.3 million. The rest came from Solana, Stellar, Arbitrum, Tron, Polygon, Avalanche, BNB Chain and XDC.
Between Nov 3 and the morning of Nov 4 UTC, the attacker sold about $11.9 million of tokens for ETH. As of Nov 4, the wallets held roughly 8,678 ETH across 10 addresses, while 106 BTC sat untouched in a single address.
Tether, Circle, Paxos, Agora and Ripple froze part of the funds. Bitquery tallies about $11.8 million, while CoinDesk cites the exchange saying partners helped freeze over $15 million.
What it means for crypto markets
The incident is far smaller than the $6.3 billion Binance hack and has had no clear price impact. Bitcoin traded near $79,700 on Nov 5, according to CoinDesk.
- Bull case: Mercado Bitcoin covers all user losses as pledged, most stablecoins stay frozen, and the fallout stays local to Brazil.
- Risk case: More mid-sized exchanges disclose similar breaches, deepening concern over hot-wallet security and pushing funds off centralized platforms.
This is the second exchange incident this week that may be tied to the same group, following BitMart's disclosure. Bloomberg also reported that the T3 Financial Crime Unit set up by Tron, Tether and TRM Labs has been disbanded.
What to watch next
- Nov 9: Mercado Bitcoin's website is due to reopen in view-only mode.
- A date for resuming withdrawals and an official root-cause report.
- Confirmation from BitMart on its losses and any link to the Mercado attack.
- Movement of the 106 BTC and roughly 8,678 ETH held by the attacker.
Track market stress on our real-time liquidations page and economic calendar.
Frequently Asked Questions
Will Mercado Bitcoin customers lose money?
The exchange says customers will not lose funds and the company will absorb the loss. Deposits and withdrawals remain suspended for now.
Why do the loss estimates differ?
Bitquery values each transfer at the time it happened, arriving at about $48.6 million. The exchange cites about $38 million but has not explained its method.
Is it safe to send funds to old Mercado Bitcoin deposit addresses?
Bitquery advises waiting for official guidance, since the attacker may still control those deposit addresses.
*This content is for information only and is not financial advice.*
Tags: Mercado Bitcoin, Hack, Security, Exchanges
Related articles
- Bitcoin Falls Below $76,000 as Nasdaq Tumbles 4%, Crypto Liquidations Top $1B
- Trump Media Moves 4,259 BTC ($342M) to Crypto.com Ahead of Nov 30 Debt Put
- Bitcoin Reclaims $80,000 as Over $400 Million Liquidated in One Hour
- Bitcoin Rebounds to $78,500 From 7-Week Low as Spot ETF Outflows Slow to $116M
- ZachXBT names French bank Crédit Mutuel Arkéa in alleged $133M crypto theft
- Binance says $6.3 billion hack began with a fake job interview