New research reveals that Mercado Bitcoin, a major cryptocurrency exchange in Brazil, suffered continued drains from its customer deposit addresses for nearly four hours after initially reporting its security breach had been contained. The findings raise questions about the extent of the attack and how quickly its impact was truly managed.
Blockchain analysis uncovers prolonged asset drains
Bitquery, a blockchain data analytics firm, reported that an attacker was able to access and empty 36,042 Ethereum deposit addresses linked to Mercado Bitcoin between 9:27 a.m. and 1:56 p.m. Brazil time on November 2. This activity occurred after the exchange made a public statement at 9:56 a.m. declaring the incident under control.
The affected deposit addresses held approximately $266,000 at the time, a relatively minor portion of the overall loss. However, the ability of the attacker to continue moving assets after the claimed containment has heightened concerns about the security of the exchange’s infrastructure.
Despite Mercado Bitcoin’s early statement that it had stopped the breach, Bitquery tracked ongoing asset drains for hours and said, “that needs a key for each address, or a way into the system that signs for them.”
Most exchanges use deposit addresses as personal accounts for receiving cryptocurrency from customers, later aggregating these funds into a ‘hot wallet’ for day-to-day operations. The movement of funds from individual deposit addresses suggests the attacker gained either direct access to numerous private keys, or to a system that can sign transactions for many accounts collectively.
Mini dictionary: Hot wallet, a cryptocurrency wallet connected to the internet and used by exchanges or individuals to process frequent transactions and provide liquidity. It is more vulnerable to hacks compared to cold wallets, which are kept offline.
Conflicting loss estimates and security warnings
Bitquery’s updated research traces $48.6 million in stolen assets across 11 different blockchain networks, significantly higher than Mercado Bitcoin’s current estimate of $36.3 million cited in its FAQ. Initial appraisals immediately after the incident had suggested losses above $40 million. The exchange has so far not provided detailed explanations for the discrepancies among these figures or for the post-containment asset movements.
| Source | Reported Amount Stolen | Number of Networks | Reporting Date |
|---|---|---|---|
| Initial market estimates | Over $40 million | Not specified | November 2 |
| Mercado Bitcoin FAQ | $36.3 million | Not specified | Latest available |
| Bitquery analysis | $48.6 million | 11 blockchains | Updated November 9 |
Bitquery has advised Mercado Bitcoin’s users not to reuse their previous deposit addresses until the exchange confirms they are secure. The analytics firm also pointed out that exchanges customarily derive multiple deposit addresses from a single master key, increasing the risk that more funds could be at risk if the key was compromised.
Exchange response and service resumption plans
Mercado Bitcoin has told customers it will absorb the financial loss from the hack. The company plans to reopen account viewing beginning November 9. However, no timetable has been given for the resumption of deposits, withdrawals, or trading functions, all of which remain suspended for the time being.
Mercado Bitcoin has not provided additional public details explaining the lag in containment or the difference in loss estimates, though it has assured users they will be made whole.
The ongoing investigation and disparity in figures have prompted wider scrutiny of security practices at exchanges operating in Brazil, underscoring the need for transparent communication in the event of a breach.
