Choose a section or paragraph
Brazilian cryptocurrency exchange Mercado Bitcoin suffered a major security breach on November 2, with blockchain investigators tracing approximately $48.6 million in assets transferred across 10 networks.
But the most troubling finding is not simply the size of the theft.
According to blockchain analytics firm Bitquery, the attacker continued emptying thousands of customer deposit addresses after Mercado Bitcoin publicly indicated that the security incident had been contained.
The discrepancy raises questions about the scope of the compromise, the effectiveness of the exchange’s response, and the safeguards protecting customer deposit infrastructure.
Cryptopian News examined the available blockchain research, the exchange’s reported statements, and the limits of what those records establish.
What Happened During the Mercado Bitcoin Attack?
On November 2, Mercado Bitcoin confirmed that it had experienced a security incident involving one of its systems.
The exchange temporarily suspended deposits and withdrawals while investigating suspicious transactions and coordinating with relevant parties.
Its initial public response emphasized that the incident had been identified and contained quickly. The company also indicated that customers would not bear losses from the attack.
Blockchain intelligence providers subsequently identified suspicious transfers involving Bitcoin, Ethereum, and several other supported networks.
The Block initially reported an estimated $46.3 million incident based on Arkham data.
Bitquery’s updated November 3 investigation calculated that approximately $48.6 million had left exchange-associated wallets across 10 blockchains.
The difference illustrates why early estimates should be treated as provisional rather than final audited losses.
The Timeline That Raises Security Questions
Bitquery’s reconstruction identifies two important phases of the incident.
During the initial phase, funds left exchange hot wallets across multiple blockchains in approximately 25 minutes.
On Ethereum alone, the firm’s analysis identified roughly $29.5 million in transfers from the exchange’s hot wallet.
The second phase involved a different infrastructure component: individual customer deposit addresses.
Bitquery recorded activity involving 36,042 Ethereum deposit addresses between approximately 12:27 UTC and 16:56 UTC on November 2.
Mercado Bitcoin’s public containment statement was issued at approximately 12:56 UTC, according to the research.
That means activity attributed to the attacker continued for roughly four hours after the statement.
This does not, by itself, prove that Mercado Bitcoin knowingly misrepresented the situation.
It does, however, expose a significant distinction between containing an initial intrusion and securing every affected wallet or signing system.
Why Were Thousands of Deposit Addresses Affected?
Centralized cryptocurrency exchanges often assign individual blockchain deposit addresses to customers.
When a customer sends cryptocurrency to one of these addresses, the exchange typically credits the customer’s internal account.
The exchange may later consolidate those assets into operational wallets.
This arrangement requires secure management of the private keys or signing infrastructure controlling those deposit addresses.
Bitquery’s findings suggest that the attacker was able to authorize outgoing transfers from many individual addresses, not merely withdraw from a single hot wallet.
That distinction matters.
Compromise of one operational wallet can be damaging. Compromise of a broader signing system or multiple deposit credentials may expose a much larger portion of an exchange’s infrastructure.
The exact technical method used in the Mercado Bitcoin incident has not been conclusively established in the public evidence reviewed here.
Where Did the Stolen Cryptocurrency Go?
Bitquery’s updated investigation identified movements across Ethereum, Bitcoin, Solana, Tron, Stellar and several additional networks.
Ethereum accounted for the largest portion of the reported losses.
The researchers also identified 106.07 BTC held at an attacker-associated Bitcoin address at the time of their latest analysis.
On Ethereum, stolen assets were redistributed across additional addresses. Some assets were also exchanged through cross-chain services.
Those movements matter because investigators must distinguish between assets remaining at an identifiable address and assets that have passed through trading venues or bridges.
Moving funds across networks does not necessarily make them untraceable, but it can complicate recovery, attribution and enforcement.
How Much Was Frozen?
According to Bitquery’s November 3 update, stablecoin issuers had frozen approximately $11.4 million connected to the incident.
The report identified actions involving issuers including Tether, Circle and Paxos.
This is an important distinction in blockchain security.
Centralized stablecoin issuers may possess technical controls that allow certain tokens to be frozen under applicable procedures.
Native assets such as Bitcoin and Ether generally do not have the same issuer-controlled freezing mechanism.
However, freezing an asset is not the same as recovering it or returning it to an affected party.
The amount ultimately recovered will depend on subsequent investigation, asset movements, issuer action and applicable legal processes.
The Wallet Evidence Worth Examining
Bitquery’s investigation identifies the following Ethereum addresses as relevant to its transaction tracing.
Exchange-associated hot wallet:
0x5cc7787778b4d20a947dcc53b41f593cfd27d548
Attacker-associated destination address:
0xe485e7a70b1131216cb47ca4555c4bbb2c742478
Attacker-associated Bitcoin address:
19qGpsHvzh1t6pVi526XNNkh6hW6prDZp
These addresses are presented for transparency and independent examination. Their classification relies on the cited blockchain investigation and should not be interpreted as a legal finding about the identity of the attacker.
What Remains Unanswered?
The available evidence leaves several questions unresolved.
First, what specific security weakness allowed the attacker to move assets from both operational wallets and individual deposit addresses?
Second, when did the exchange determine that the deposit-address signing infrastructure was affected?
Third, did the initial containment response eliminate access to the primary systems involved, or did additional compromised signing capabilities remain active?
Fourth, what controls will prevent future customer deposits from reaching addresses that may no longer be secure?
Finally, what independent evidence will substantiate the exchange’s commitment to protect customers from losses?
These questions require answers from Mercado Bitcoin, its incident-response investigators, and potentially relevant regulators.
What This Incident Reveals About Centralized Exchanges
The Mercado Bitcoin breach illustrates a structural concern for centralized cryptocurrency platforms: customers may hold an account balance on an exchange while the underlying assets depend on centralized custody and key-management systems.
A breach affecting that infrastructure can potentially expose assets across several blockchains simultaneously.
It also demonstrates why a public statement that an attack has been contained should be supported by continuing on-chain monitoring.
Containing one attack vector does not automatically guarantee that every compromised address, credential or authorization path has been secured.
For customers, the practical lesson is to verify deposit instructions directly through official exchange channels and avoid sending funds to previously issued addresses following a significant security incident unless the exchange explicitly confirms that they remain valid.
Cryptopian News Assessment
The verified research supports the conclusion that Mercado Bitcoin experienced a substantial cross-chain theft, with continued suspicious deposit-address activity after its initial containment announcement.
It does not establish the identity of the attacker, prove intentional misconduct by exchange executives, or conclusively identify the initial intrusion method.
The immediate investigative priority is determining how widespread signing access was compromised and whether the exchange’s corrective actions fully secured the affected infrastructure.
Cryptopian News will distinguish confirmed disclosures, third-party on-chain findings and unresolved allegations as the investigation develops.
Sources and Methodology
FBI Identifies 628 Wallets in Binance’s $6.3 Billion Hack: Where Did the Stolen Crypto Go?
Binance Replaces $6B After Hack: What Remains Missing
This article is an independent editorial analysis of publicly reported statements and third-party blockchain research, not a claim that Cryptopian News performed the original transaction tracing. Figures reflect Bitquery’s November 3 update and may change with further investigation.
- Mercado Bitcoin Hack: $48.6 Million Stolen Across 10 Blockchains as Wallet Drains Continued After Containment Claim - November 4, 2026
- FBI Identifies 628 Wallets in Binance’s $6.3 Billion Hack: Where Did the Stolen Crypto Go? - November 2, 2026
- Binance Replaces $6B After Hack: What Remains Missing - November 1, 2026