An attacker continued siphoning crypto assets from Brazilian exchange Mercado Bitcoin on November 2, 2026, for roughly four hours after the company said it had contained the cyberattack, according to Bitquery. The continued transfers call into question the effectiveness of the exchange’s initial containment measures and contributed to Bitquery’s estimate of $48.6 million in total losses.

Mercado Bitcoin published a statement at 12:56 UTC saying the security incident had been promptly contained, according to a Bitquery analysis of transactions across 11 blockchains. Bitquery said onchain data showed unauthorized transfers continuing until 16:56 UTC.

Hot wallets and deposit addresses drained

Bitquery said the attack unfolded in several stages. The attacker first drained Mercado Bitcoin’s hot wallets across multiple networks, withdrawing assets worth $29.5 million from the exchange’s main Ethereum wallet within 24 minutes. The assets included 2,852 ETH, the USDT and USDC stablecoins, and other tokens.

On Ethereum, the attacker began draining customer deposit addresses at 12:27 UTC, before Mercado Bitcoin issued its containment statement. Over the next four and a half hours, funds totaling about $266,000 were withdrawn from 36,042 addresses. Bitquery said most of those transactions occurred after the exchange’s announcement.

A few hours after draining the hot wallets, the attacker systematically transferred remaining assets from customer deposit addresses to wallets under the attacker’s control, according to Bitquery. Each transfer was signed directly by the sender address, which the analysts said indicated that the attacker had access to the relevant private keys or to infrastructure capable of signing the transactions.

Bitquery observed similar activity on BNB Chain and Base. One wallet linked to Mercado Bitcoin sent about $124,000 to the attacker by 18:08 UTC, more than five hours after the exchange said it had contained the incident.

Bitquery estimates losses at $48.6 million

Bitquery estimated the stolen assets’ total value at $48.6 million, with about 61% of the losses occurring on Ethereum. The analysts said the precise mechanism behind the initial breach of Mercado Bitcoin’s infrastructure remained unknown.

Stablecoin issuers had frozen about $11.8 million at the time of Bitquery’s analysis. The frozen assets included $5.9 million attributed to Tether, $4.3 million to Circle and about $1.5 million to Paxos.

The attacker subsequently began redistributing the stolen funds. On November 3 and 4, the attacker swapped 136 tokens worth a combined $11.9 million for ETH through the MetaMask service. At the latest check cited in the report, 8,678 ETH remained under the attacker’s control across 10 Ethereum wallets. The attacker also controlled 106.07 BTC that had not moved.

Mercado Bitcoin previously reported a security incident involving assets worth about $38 million. The exchange said users would not incur financial losses and temporarily suspended deposits and withdrawals.

Source: Incrypted