Mercado Bitcoin Hack Reaches $48.6M Across Ten Blockchains, Bitquery Finds

Brazilian cryptocurrency exchange Mercado Bitcoin lost $48.6 million across ten separate blockchains following a security breach on Nov. 2, according to an onchain investigation published by Bitquery ¹. The exploit involved an attack on the platform's systems overnight, prompting the exchange to halt customer deposits and withdrawals ¹. While Mercado Bitcoin stated on X shortly after midday UTC that the incident was quickly contained and promised no users would lose funds, Bitquery documented that an attacker systematically swept funds for approximately four hours after the announcement ¹.

The breach unfolded in two distinct operational phases ¹. In the initial sweep, the perpetrator drained the exchange's primary hot wallets across ten networks in just 25 minutes, between 06:24 and 06:50 UTC ¹. Ethereum accounted for the largest loss at $29.72 million, followed by $8.30 million in Bitcoin ($BTC), with the remaining funds taken from networks including Solana, Tron, Arbitrum, Polygon, and Stellar ¹. Notably, the Ethereum hot wallet disbursed 2,852 $ETH before offloading Tether ($USDT) and Circle ($USDC), followed by dozens of other token balances ¹.

Master Key Compromise Sweeps Deposit Wallets

Hours after the hot wallets were cleared, the attacker began signing transactions directly from user deposit accounts, indicating a deeper architectural breach ¹. Between 12:27 and 16:56 UTC, the perpetrator systematically emptied 36,042 individual deposit addresses on Ethereum, collecting roughly $266,000 ¹. Similar deposit sweeps occurred on BNB Chain and Bitcoin ¹. Because centralized exchanges generate individual deposit addresses from an underlying master key, Bitquery noted that the hacker retained the ability to sign transactions on behalf of users, necessitating the continuous freeze on incoming deposits to prevent further losses ¹.

Asset issuers managed to mitigate a portion of the theft ¹. Stablecoin firms including Tether, Circle, and Paxos froze $11.8 million across multiple chains ¹. However, the attacker converted $11.9 million of the stolen tokens into ETH through decentralized swaps on Nov. 3 and Nov. 4, bringing their Ethereum holdings to 8,678 ETH ¹. Meanwhile, 106.07 BTC remained static in the attacker's Bitcoin wallet ¹. The incident also revealed potential cross-venue targeting, as wallets linked to exchange BitMart were drained of $391,000 less than an hour before Mercado Bitcoin's systems were breached ¹. The systemic risks tied to rapid multi-chain outflows echo ongoing discussions around protective custody architecture, including proposals from figures like Austin Campbell who urged 24-hour delays on large crypto transfers to halt unauthorized capital flight.