Mercado Bitcoin Hack: $48.6M Estimated Stolen as Funds Kept Moving After Exchange Claimed Control
Attackers kept moving funds for almost four hours after Brazilian crypto exchange Mercado Bitcoin said it had contained a security incident, according to Decrypt.
Bitquery data shows 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time on Nov. 2. Mercado Bitcoin said the incident was under control at 9:56 a.m. that day. Bitquery puts losses across 11 blockchains at $48.6 million, above the latest Mercado Bitcoin estimate of $36.3 million.
Transfers to the affected Ethereum deposit addresses were authorized directly by the address, Bitquery said, suggesting the attacker may control the relevant private key or have access to a signature delegation system.
Mercado Bitcoin said it will use its own funds to compensate affected users and advised customers not to reuse old deposit addresses until it confirms security. The exchange plans to restore account balance viewing on Nov. 9. Deposits, withdrawals and trading remain suspended, with no confirmed date for resumption.