Mercado Bitcoin breach losses rise as Bitquery finds attack continued for hours

Traders Union
All News
Crypto
Mercado Bitcoin breach losses

Highlights

Bitquery found the Mercado Bitcoin attacker drained 36,042 Ethereum addresses holding about $266,000 between 12:27 and 16:56 UTC on Nov. 2, despite the company's containment claim.
The estimated total theft has risen to $48.6 million across 10 blockchains, up from the previously reported $40 million, raising concerns over the breach's scale and duration.
Bitquery links the Mercado Bitcoin and BitMart breaches, attributing $391,000 in losses to BitMart and suggesting the attacker accessed infrastructure used by multiple exchanges.

Blockchain timeline raises containment concerns

As reported by CoinDesk, citing Bitquery, the attacker continued draining 36,042 Ethereum customer deposit addresses between 12:27 and 16:56 UTC on Nov. 2, even though Mercado Bitcoin said at 12:56 UTC that the breach had been contained.

Those Ethereum addresses held about $266,000, and the broader tracing lifted the estimated theft to $48.6 million across 10 blockchains, above the $40 million first reported. The findings suggest the hacker gained access to systems used to manage customer deposits and cast doubt on how quickly the Brazilian crypto exchange brought the incident under control.

Mercado Bitcoin is not immediately available for comment. The exchange has pledged to cover all user losses, and partners including Tether, Circle and Chainalysis have helped freeze more than $15 million.

Possible links to BitMart widen exchange security questions

The investigation also points to a separate attack involving wallets Bitquery believes belong to BitMart. The same attacker-controlled address began receiving funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin breach, with Bitquery attributing roughly $391,000 in losses to those wallets.

BitMart has not confirmed that loss figure, but founder Sheldon Xia says the exchange was hacked on Nov. 2 and that its preliminary investigation points to the same group behind the Mercado Bitcoin attack. The overlap raises the possibility that the attacker accessed infrastructure used by multiple exchanges, although the cause of the breaches remains unknown.

Mercado Bitcoin suspended deposits and withdrawals after the attack and is set to reopen its website in view-only mode on Nov. 9. The company has not given a date for restoring deposit or withdrawal services.

Cybersecurity funding surged in Q3 as investors doubled down on AI-driven and identity security startups, with fewer deals but much larger late-stage rounds. Our earlier article also highlighted accelerating consolidation, as well-capitalized companies pursued major acquisitions to strengthen fraud prevention and security capabilities in response to evolving threats.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.