--- title: "Mercado Bitcoin Hack Reaches $48.6M Across Ten Blockchains, Bitquery Finds" description: "Onchain investigator Bitquery reports that the attacker compromised master signing keys, draining 36,042 Ethereum deposit addresses after the exchange claimed containment." url: https://basisdesk.news/news/mercado-bitcoin-hack-bitquery-investigation published: 2026-11-04T22:56:16.987Z modified: 2026-11-04T22:56:16.987Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [BTC, ETH, USDT, USDC] tags: [mercado-bitcoin, hacks, ethereum, stablecoins, onchain-analysis] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Mercado Bitcoin Hack Reaches $48.6M Across Ten Blockchains, Bitquery Finds Onchain investigator Bitquery reports that the attacker compromised master signing keys, draining 36,042 Ethereum deposit addresses after the exchange claimed containment. ## At a glance - **What happened:** An attacker drained $48.6 million from Mercado Bitcoin's hot wallets and 36,042 Ethereum deposit addresses on Nov. 2. - **Why it matters:** The attacker obtained signing capabilities for deposit addresses, forcing ongoing deposit and withdrawal halts across the exchange. - **Who is affected:** Mercado Bitcoin and its depositors across ten supported blockchain networks. - **What's next:** No next step announced. - **Primary source:** [Mercado Bitcoin Hack: $48.6M Taken on 10 Blockchains](https://www.bitquery.io/investigations/mercado-bitcoin-hack) — bitquery.io ## Key points - Mercado Bitcoin lost $48.6M across 10 blockchains in a Nov. 2 hack, with Ethereum accounting for $29.72M. - The attacker emptied 36,042 customer deposit addresses on Ethereum, continuing four hours after the exchange claimed containment. - Stablecoin issuers Tether, Circle, and Paxos froze $11.8M, while the hacker swapped $11.9M of stolen tokens for ETH. ## Editorial remark - **Context:** Mercado Bitcoin paused customer deposits and withdrawals on Nov. 2 following an overnight system compromise. Initial external estimates placed the loss around $40 million before onchain data revealed widespread hot wallet and deposit address drains totaling $48.6 million across ten separate networks. - **Impact:** Mercado Bitcoin users remain unable to deposit or withdraw funds. Although the exchange pledged to cover customer losses and stablecoin issuers froze $11.8 million, compromised deposit derivation keys mean any future deposits sent to old addresses remain vulnerable to theft. - **Watch:** Watch for Mercado Bitcoin to deploy fresh deposit architecture and resume withdrawals, alongside onchain tracking of the attacker's 8,678 ETH and 106.07 BTC. Brazilian cryptocurrency exchange Mercado Bitcoin lost $48.6 million across ten separate blockchains following a security breach on Nov. 2, according to an onchain investigation published by Bitquery [1]. The exploit involved an attack on the platform's systems overnight, prompting the exchange to halt customer deposits and withdrawals [1]. While Mercado Bitcoin stated on X shortly after midday UTC that the incident was quickly contained and promised no users would lose funds, Bitquery documented that an attacker systematically swept funds for approximately four hours after the announcement [1]. The breach unfolded in two distinct operational phases [1]. In the initial sweep, the perpetrator drained the exchange's primary hot wallets across ten networks in just 25 minutes, between 06:24 and 06:50 UTC [1]. Ethereum accounted for the largest loss at $29.72 million, followed by $8.30 million in Bitcoin ($BTC), with the remaining funds taken from networks including Solana, Tron, Arbitrum, Polygon, and Stellar [1]. Notably, the Ethereum hot wallet disbursed 2,852 $ETH before offloading Tether ($USDT) and Circle ($USDC), followed by dozens of other token balances [1]. ## Master Key Compromise Sweeps Deposit Wallets Hours after the hot wallets were cleared, the attacker began signing transactions directly from user deposit accounts, indicating a deeper architectural breach [1]. Between 12:27 and 16:56 UTC, the perpetrator systematically emptied 36,042 individual deposit addresses on Ethereum, collecting roughly $266,000 [1]. Similar deposit sweeps occurred on BNB Chain and Bitcoin [1]. Because centralized exchanges generate individual deposit addresses from an underlying master key, Bitquery noted that the hacker retained the ability to sign transactions on behalf of users, necessitating the continuous freeze on incoming deposits to prevent further losses [1]. Asset issuers managed to mitigate a portion of the theft [1]. Stablecoin firms including Tether, Circle, and Paxos froze $11.8 million across multiple chains [1]. However, the attacker converted $11.9 million of the stolen tokens into ETH through decentralized swaps on Nov. 3 and Nov. 4, bringing their Ethereum holdings to 8,678 ETH [1]. Meanwhile, 106.07 BTC remained static in the attacker's Bitcoin wallet [1]. The incident also revealed potential cross-venue targeting, as wallets linked to exchange BitMart were drained of $391,000 less than an hour before Mercado Bitcoin's systems were breached [1]. The systemic risks tied to rapid multi-chain outflows echo ongoing discussions around protective custody architecture, including proposals from figures like [Austin Campbell who urged 24-hour delays on large crypto transfers](https://basisdesk.news/news/austin-campbell-calls-24-hour-timelock-billion-dollar-crypto-transfers) to halt unauthorized capital flight. ## Sources 1. [Mercado Bitcoin Hack: $48.6M Taken on 10 Blockchains](https://www.bitquery.io/investigations/mercado-bitcoin-hack) — bitquery.io, 2026-11-02 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai