Mercado Bitcoin Hack Drains About $49 Million, Halts Deposits and Withdrawals
Key Facts
Brazilian platform Mercado Bitcoin was hacked on November 2 in an attack targeting its hot wallets. Chainalysis estimated that about $49 million was stolen across assets on 17 blockchain networks. In a tracing report published on November 3, Bitquery counted about $48.6 million leaving the platform’s wallets across 10 networks. The figures reflect different tracking totals and therefore do not represent one agreed loss amount. The company said the incident was limited to hot wallets used in daily operations, while cold wallets were unaffected. The platform temporarily halted deposits and withdrawals as a precaution while teams investigate the incident, trace the assets and coordinate with authorities.
Bitquery said funds left Mercado Bitcoin’s hot wallets across 10 networks and that the attacker emptied 36,042 Ethereum deposit addresses. According to its analysis, the attacker also had the ability to sign transfers from customers’ deposit addresses at the platform. Chainalysis provided a broader account of the asset movements, saying they moved across 17 networks in waves of draining. That total differs from Bitquery’s tracking, which detected funds leaving across 10 networks, and the two firms’ estimates of the stolen value also differ. These details place Ethereum deposits among the attack paths covered by Bitquery’s tracking.
Bitquery said Ethereum deposit addresses continued to be emptied for about four hours after the platform announced it had contained the attack. It said Mercado Bitcoin announced containment at 12:56 UTC on November 2, but transfers from those addresses continued afterward. This timeline adds detail to the platform’s initial response as teams tracked the movement of assets and coordinated over them. The company did not give a specific date for resuming service in its official update. It said the platform would return to operation only after operational safety had been confirmed.
In an update on the evening of November 2, Mercado Bitcoin said it had blocked about $11 million in assets, while about $38 million remained unblocked at that time. Chainalysis gave a separate tally of freezing efforts, saying work in which it participated resulted in a total of $9 million being frozen in the hours after the attack. The figures do not match: the first is the amount the company said it had blocked in its update, while the second is the total Chainalysis said its efforts had frozen. Chainalysis said it coordinated with Paxos, Anchorage Digital, Ripple, Circle, Tether and law enforcement agencies. The company said blocking assets depends on identifying what can be frozen and coordinating with relevant parties and stablecoin issuers.
Mercado Bitcoin said customers would not lose their assets and that the incident did not result in their data being leaked, according to CoinDesk. The company also confirmed it would ensure customers did not lose their assets and tied the resumption of service to confirming operational safety. It did not specify a return date in its update, leaving the timing of resumed deposits and withdrawals contingent on verifying the security of operations. At the time of CoinDesk’s report, how the attacker obtained signing authority remained unknown. The platform said deposits and withdrawals would remain halted as a precaution during the investigation, the tracing of funds and coordination with authorities.
Chainalysis said its analysts from three continents took part in a digital war room to coordinate the response and discuss fund flows. Their priorities included tracing assets, identifying opportunities to intervene, and coordinating with law enforcement agencies and stablecoin issuers. The company added that it was continuing to trace the remaining funds, monitor their movements and identify further opportunities to intervene. This comes as the amount of unblocked funds, according to the platform’s update, remained at about $38 million on the evening of November 2. The company said continued tracing was aimed at identifying more assets that could be subject to intervention.
The Block’s coverage placed the Mercado Bitcoin hack among a wave of incidents in the sector in the days beforehand. It cited a $6 billion Binance hack on the Thursday before its November 2 report, and also noted a $2.65 million exploit targeting Polymarket on the same day referenced in the report. This context coincides with differing estimates of the size of the Brazilian platform’s hack: Chainalysis put it at about $49 million, while Bitquery tracked $48.6 million. In the response, Mercado Bitcoin said it would not return the platform to operation before confirming operational safety. The company did not specify a date for resuming service.