Mercado Bitcoin (BTC) Hack Emptied 36,042 Addresses 4 Hours Past Containment Claim

36,042 Addresses Emptied Over Four Hours

The transfers out of Mercado Bitcoin (BTC) kept running for close to four hours after the Brazilian exchange told customers it had contained a hack. The Bitcoin (BTC) price slid 5.5% over the past 24 hours while the forensic picture came together. On-chain work published Thursday, November 5, now fixes the timeline: an investigation from blockchain analytics firm Bitquery shows attackers emptied 36,042 Ethereum deposit addresses tied to the exchange between 9:27 a.m. and 1:56 p.m. Brazil time on November 2. The company's containment announcement went out at 9:56 a.m. that day, so outflows had been moving for 29 minutes before the exchange declared the incident closed, and they ran on for nearly four hours more. Those 36,042 addresses held roughly $266,000, a small slice of the total theft, but the attacker could still move their contents long after the statement. A deposit address works as the individual receiving account an exchange assigns to each customer, and pulling funds from one requires that address's private key. Bitquery's running estimate now stands at $48.6 million in stolen assets across 11 blockchains, above the $36.3 million Mercado Bitcoin (BTC) posted to its official X account on November 4. The same attacker address had also received about $391,000 from wallets on Base, Arbitrum and Optimism before the main drain, most of it traced by the researchers to BitMart, which has not confirmed the amount. BitMart founder Sheldon Xia said his exchange was hacked on November 2 and that a preliminary investigation points to the group behind the Mercado Bitcoin breach.

A $12.3 Million Gap in the Totals

The disputed figures have not been reconciled. Early assessments put affected assets above $40 million, the exchange's updated FAQ now lists about $36.3 million, and the on-chain count reaches $48.6 million spread across 11 networks. Three numbers now sit side by side without an official bridge between them. The company's public updates have not explained why transfers continued after the containment claim, nor the spread between its own figure and the chain data; it has assured customers it will cover user losses with its own funds. The mechanism behind the theft explains why the question stays open. A customer deposit address functions much like a personal receiving account: the exchange assigns one to each user, then gathers the coins into a shared hot wallet that processes everyday transactions. Authorizing a transfer out of such an address requires its private key, and the withdrawals in this case were signed directly by the deposit addresses themselves. Bitquery's researchers wrote that pulling this off needs a key for every address, or a way into whatever system signs for them. They also flagged a structural risk: exchanges typically derive deposit keys from a single master key, so an attacker holding that master material may still be able to reach other customer addresses. The roughly $12.3 million gap is larger than the entire balance of the drained Ethereum addresses, and until Mercado Bitcoin (BTC) confirms individual addresses are safe, the guidance is not to reuse old deposit addresses. The reopening plan the exchange published on November 4 starts with balance viewing only on November 9; deposits, withdrawals and trading have no restart date, which leaves customers holding funds on an old address with no way to move them until withdrawals come back.

Read against the chain record, the episode looks like a key-custody failure rather than a protocol flaw such as a replay attack: the attacker exercised signing authority over tens of thousands of individual addresses, one by one, across a four-hour window. The 29-minute overlap between live outflows and the containment statement will draw the sharpest scrutiny of the exchange's incident response, and the spread between the FAQ figure and the on-chain count suggests its accounting still trails the chain. Whether exposure is truly closed turns on the master-key question; the November 9 view-only reopening, and any regeneration of deposit addresses, is the next checkpoint. The breach also landed during a soft tape, with the 5.5% slide leaving the market facing a $76,155 support test.