Mercado Bitcoin Hack Losses Estimated at $36 Million to $49 Million as Attack Continued After Containment Claim
Brazilian exchange Mercado Bitcoin's hack losses are estimated between $36.3 million and $49 million, depending on the source, with Chainalysis and Bitquery tracing theft across 11 to 17 blockchains. Blockchain data shows deposit addresses were drained nearly four hours after the exchange said the breach was contained, and services remain suspended.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Loss Estimates Diverge Across Sources
The size of the Mercado Bitcoin breach depends on which figure is used. Chainalysis puts the total at $49 million across 17 chains, while Bitquery's analysis, updated Thursday, traces more than $48 million across 11 blockchains. Mercado Bitcoin's own updated FAQ is lower, placing affected assets at about $36.3 million. Initial estimates were above $40 million. The gap reflects differences in chain coverage and in how each party counts assets, and the sources do not fully reconcile it.
Containment Claim Versus On-Chain Activity
Mercado Bitcoin announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time, roughly four hours after that announcement. Those addresses held about $266,000, a small share of the total, but the withdrawals show the attacker could still move funds after the exchange said the threat was under control.
Bitquery says the withdrawals were authorized directly from the deposit addresses, which would require either the private key for each address or a system able to sign transactions on their behalf. Researchers noted that exchanges often derive deposit keys from a single master key, so other customer addresses may remain exposed. Mercado Bitcoin's public updates have not explained the gap between its containment claim and the later transfers.
Customer Compensation and Reopening
Mercado Bitcoin has said it will cover user losses with its own funds, and the Chainalysis-cited statement says $11 million has been blocked. Bitquery advises customers not to reuse old deposit addresses until the exchange confirms they are safe. The reopening plan starts November 9 with balance viewing only. Deposits, withdrawals and trading have no restart date.
Why It Matters
For Traders
Mercado Bitcoin's services stay suspended with no trading restart date, so any exposure to its venue or to funds held there carries unresolved withdrawal risk.
For Investors
The exposure gap between the exchange's containment claim and later on-chain transfers raises questions about custody controls at Brazilian exchanges handling large balances.
For Builders
Deposit addresses derived from a single master key mean one compromised signing system can expose many customer addresses, so key management design deserves review.
This article is for information only and is not financial advice. Read the full disclaimer.
