<p>Mercado Bitcoin claims to have contained the hacking that targeted its platform on November 2. However, Bitquery’s analysis reveals that thousands of deposit addresses lost their funds after this announcement. Researchers tracked 48.6 million dollars worth of assets across eleven blockchains. This timeline questions the actual moment of containment and the extent of the access obtained by the attacker, especially concerning bitcoin-related funds. It highlights the limits of the initial public information.</p>
<div class="in-brief">
 <div class="in-brief--container"><span></span><span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Bitquery reveals that 36,042 Ethereum addresses were emptied after the hacking containment announcement.</li>
   <li>The investigation traces $48.6 million of stolen cryptocurrencies across eleven blockchains.</li>
   <li>Researchers suspect access to private keys or a vulnerability in the authentication system.</li>
   <li>Mercado Bitcoin promises to reimburse customers and plans a gradual recovery starting November 9.</li>
  </ul>
 </div>
</div>
<h2 id="h-bitquery-traces-transfers-after-the-announcement">Bitquery traces transfers after the announcement</h2>
<p>The platform announced on November 2 at 9:56 AM that it had contained the incident. However, Bitquery identifies movements after this communication. 36,042 <a href="https://www.cointribune.com/en/tag/ethereum-eth-en/" rel="noopener noreferrer nofollow">Ethereum</a> deposit addresses were emptied between 9:27 AM and 1:56 PM. Transfers continued nearly four hours after the announcement.</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<p>These addresses contained about $266,000, a small part of the estimated amount. The emptying of these addresses remains important to understand the timeline. The data shows that the hacker could move funds after the <a href="https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2965274628/9%2B56hs%2B02%2B11%2B2026%2B-%2BAtualiza%2Bo" rel="noopener noreferrer nofollow">Mercado Bitcoin announcement</a>. They concern customer deposits, not just a central wallet.</p>
<p>A deposit address receives cryptocurrencies from a customer. The platform pools the assets into a shared hot wallet for daily operations. Each transfer requires a private key. Here, withdrawals seem to have been directly authorized by the concerned addresses, according to the <a href="https://www.bitquery.io/investigations/mercado-bitcoin-hack" rel="noopener noreferrer nofollow">Bitquery analysis</a>.</p>
<div class="affiliate-button"><a href="https://www.bybit.eu/en-EU/sign-up?affiliate_id=133743" rel="noopener noreferrer nofollow">Start your crypto adventure safely with Bybit</a><a href="https://www.cointribune.com/en/sponsored-content/" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<h2 id="h-bitcoin-private-keys-at-the-heart-of-questions">Bitcoin private keys at the heart of questions</h2>
<p>This method suggests that the attacker had the private keys or a system capable of signing on behalf of clients. Researchers raise two lines of inquiry: obtaining a key for each address or exploiting an authentication flaw. The analysis does not decide. It highlights a risk related to the deposit architecture.</p>
<p>Platforms generate deposit keys from a single master key. If this key or its associated system was compromised, access could go beyond the emptied addresses. Bitquery warns that other deposits might remain exposed. This hypothesis also concerns bitcoin-related addresses, even if the movements described are on Ethereum.</p>
<p>Researchers recommend not reusing old addresses before official security confirmation. This instruction aims to avoid new transfers to vulnerable addresses. For bitcoin holders, caution involves verifying platform information before any operation.</p>
<h2 id="h-the-amount-of-the-theft-and-service-resumption-remain-to-be-clarified">The amount of the theft and service resumption remain to be clarified</h2>
<p>The financial assessment varies according to communications. Initial <a href="https://decrypt.co/382341/mercado-bitcoin-halts-withdrawals-40-million-hack" rel="noopener noreferrer nofollow">estimates</a> mentioned more than 40 million dollars stolen. The <a href="https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2968387585/Perguntas%2Bfrequentes" rel="noopener noreferrer nofollow">updated Mercado Bitcoin FAQ</a> reduces the amount to about 36.3 million. Bitquery estimates the stolen assets at 48.6 million dollars across eleven blockchains.</p>
<p>The gap between these estimates exceeds twelve million dollars, with no public explanation. Mercado Bitcoin does not detail why transfers continued after the declared containment. The company has, however, assured it will reimburse users’ losses with its own funds. This promise concerns its customers’ losses.</p>
<div class="tweet">
 <blockquote class="twitter-tweet"><a href="https://twitter.com/MercadoBitcoin/status/2117637227551273267?s=20?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow"></a>
 </blockquote>
</div>
<p><a href="https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2974318593/Atualiza%2Bo%2Bde%2B04%2B11%2Bs%2B18h40" rel="noopener noreferrer nofollow">The platform plans a restart as of November 9</a>. Customers will first be able to check their balances. Deposits, withdrawals, and transactions will remain unavailable at this stage. This limited opening will precede the restoration of services as users await clarification about their holdings.</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<p>The next steps will depend on the verifications and reopening announced by Mercado Bitcoin. The platform will have to specify if old addresses are safe. Until then, customers must follow its instructions and avoid any deposit to an unconfirmed address. The final assessment remains to be made.</p>

Mercado Bitcoin said to have stopped the hacking; the thefts continued, according to Bitquery

Table of Contents

Cointribune EN

Other articles published on Nov 6, 2026

Join our free newsletter for daily crypto updates!