Mercado Bitcoin Hack Ran 4 Hours After It Was 'Contained'

By Nodora News · 5 November 2026

The Mercado Bitcoin hack kept draining 36,042 Ethereum deposit addresses for four hours after the exchange said it was contained, Bitquery says.

The Mercado Bitcoin hack did not stop when Brazil's largest crypto exchange said it had. A new on-chain investigation from blockchain data firm Bitquery, published on Thursday, Nov. 5, finds that the attacker kept emptying customer deposit addresses on Ethereum (ETH) for roughly four hours after Mercado Bitcoin announced at 12:56 UTC on Nov. 2 that the breach was contained. Bitquery now puts the total taken at $48.6 million across 11 blockchains, and it links the same attacker to a smaller hack at another exchange, BitMart, on the same night.

Key takeaways

• Bitquery counts 36,042 Mercado Bitcoin deposit addresses on Ethereum that sent their full balance to the hacker between 12:27 and 16:56 UTC on Nov. 2.
• The exchange said the incident was contained at 12:56 UTC, so the sweep ran for about four hours after that statement.
• Total losses are estimated at $48.6 million across 11 chains, above the roughly $40 million first reported.
• About $11.8 million has been frozen by stablecoin issuers, led by Tether, Circle and Paxos.
• The same attacker address took about $424,000 from wallets tied to BitMart, whose founder confirmed a hack on Nov. 2.

What Bitquery found about the Mercado Bitcoin hack

Mercado Bitcoin paused deposits and withdrawals on Monday, Nov. 2, after its hot wallets (the always-online wallets an exchange uses to pay out withdrawals) on 10 chains were drained in about 25 minutes. The exchange said the attack had been identified and contained, and that no customer would lose money.

Bitquery's trace tells a longer story. Shortly after midday UTC, the exchange's individual customer deposit addresses on Ethereum began sending their entire balances to the attacker, each one signing its own transaction. That kept going until about 16:56 UTC. Similar sweeps hit 143 addresses on BNB Chain, with one busy exchange-linked wallet sending $124,000 more than five hours after the statement, and 308 deposit addresses on Base that evening.

Most of these addresses held small change. About 91% had less than $10, and together the 36,042 Ethereum addresses held around $266,000. The amount is small next to the hot-wallet losses, but the pattern matters more than the dollar figure.

Why the deposit-address sweep matters

Exchanges give every customer a unique deposit address and usually generate all of them from a single master key or one internal signing service. Being able to move funds out of tens of thousands of these addresses suggests the attacker reached the root of Mercado Bitcoin's wallet system, not just one hot wallet.

That has a practical consequence for users. Bitquery warns that coins sent to an old Mercado Bitcoin deposit address now could be taken, so customers should not deposit until the exchange confirms it is safe and issues new addresses. The exchange has not disclosed how the attacker got in, and Bitquery stresses that the chain data alone cannot prove the method.

The findings also put a question mark over how quickly the incident was really brought under control. Mercado Bitcoin was not immediately available for comment, according to CoinDesk.

The numbers: what was taken, frozen and sold

Bitquery's figures, valued at the time of each transfer:

• $48.6 million taken across 11 blockchains ($47.4 million if one thinly traded token is excluded).
• About 61% of the losses came from Ethereum, with Bitcoin the second-largest source.
• $11.8 million frozen by five stablecoin issuers. Tether froze about $5.9 million, Circle $4.3 million and Paxos $1.5 million. Circle acted roughly six hours after Tether.
• $11.9 million of 136 different tokens sold for ETH on Nov. 3 and 4 through MetaMask's swap service.
• 8,678 ETH, worth about $20.1 million, held by the attacker across ten wallets at Bitquery's last read.
• 106.07 BTC still unmoved at the attacker's Bitcoin address.

Bitquery says it has not seen any of the funds reach a centralized exchange. The exchange's own count has been different: it has cited about $49 million involved and said more than $15 million has been frozen with help from partners.

The BitMart link

The investigation also ties the same attacker address to wallets belonging to BitMart. Starting 53 minutes before the Mercado Bitcoin drain, the address took funds from BitMart-linked hot wallets on Base, Arbitrum and Optimism, and later from deposit addresses and five smaller chains, for about $424,000 in total by Bitquery's latest count.

BitMart founder Sheldon Xia confirmed on X on Nov. 3 that the exchange was "hacked yesterday too," called the amount small, and said early findings point to the Mercado Bitcoin attackers. BitMart has not published a loss figure or confirmed every wallet Bitquery named. If both attributions hold, one attacker held signing access at two exchanges on the same night, which is why Bitquery suggests looking at whether the two shared a wallet-infrastructure supplier. Nothing public confirms that yet.

Market reaction

The wider market has shrugged off the story, with prices driven mainly by the post-midterm rebound in the U.S. On OKX at the time of writing:

• Ether (ETH): about $2,419, up 3.9% in 24 hours.
• Bitcoin (BTC): about $80,330, up 2.3% in 24 hours.

The attacker's growing ETH pile is worth watching, since large sales or bridge transfers could add short-term pressure. You can follow prices on the Nodora charts page.

What to watch next for Mercado Bitcoin

• Reopening: Mercado Bitcoin plans to restore view-only access to its website on Monday, Nov. 9, with deposits, withdrawals and trading to follow in later phases. No dates have been given for those yet. Our earlier coverage explains the phased reopening plan.
• Root cause: Whether the exchange explains how the attacker reached its deposit keys, and whether it rotates every deposit address before reopening.
• The money trail: Movements of the 8,678 ETH and 106 BTC, and any more freezes by stablecoin issuers.
• BitMart: Whether BitMart publishes a loss figure or confirms a common supplier.

Mercado Bitcoin has repeatedly pledged that customers will not lose funds and that it will absorb the loss itself, as covered in our report on how the exchange vowed to cover all user losses. That promise rests on the company's own balance sheet, which on-chain data cannot verify.

This article is for information only and is not financial advice.

#Mercado Bitcoin #Ethereum #Hack #BitMart #Security

This article is general information, not financial advice.