Mercado Bitcoin Breach: Funds Drained Hours After Containment Claim

Blockchain analysis indicates that an attacker continued to drain deposit addresses linked to the Brazilian exchange Mercado Bitcoin for nearly four hours after the company announced it had contained a security breach. Bitquery's updated analysis tracked over $48 million in stolen assets across 11 blockchains.

This contrasts with Mercado Bitcoin's latest estimate of $36.3 million in affected assets. The exchange stated on November 2 at 9:56 a.m. Brazil time that the incident had been quickly contained.

Bitquery's data shows that 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time on the same day. These addresses held approximately $266,000, a small portion of the total theft, but the attacker was able to move these funds after the exchange's containment announcement.

The mechanism of withdrawal suggests the attacker had access to the private keys of individual deposit addresses or to a system capable of signing transactions on their behalf. Researchers noted that exchanges typically generate deposit keys from a single master key, raising concerns that the attacker might still have access to other customer addresses. The discrepancy between the exchange's containment claim and the subsequent transfers has not been publicly addressed by Mercado Bitcoin.

Mercado Bitcoin has committed to covering user losses with its own funds. The exchange plans to begin reopening account viewing on November 9, but deposits, withdrawals, and trading functionalities will remain suspended initially, with no specific restart date provided.

Bitquery has advised customers against reusing old deposit addresses until Mercado Bitcoin confirms their security. This precaution is crucial given the potential ongoing access to customer addresses.