Bitquery: Mercado Bitcoin Announces Address Still Drained After Containing Attack

Brazilian exchange Mercado Bitcoin declared a security incident contained, but on-chain analytics firm Bitquery reported attackers continued draining customer deposit addresses tied to the platform for nearly four more hours. Bitquery found 36,042 Ethereum deposit addresses swept on Nov. 2 for about $266,000, within a broader theft it tracks at roughly $48.6 million across 11 blockchains, while Mercado Bitcoin's latest estimate puts affected assets at about $36.3 million. Bitquery said the outflows were authorized directly by the deposit addresses, suggesting attackers held private keys or controlled a system able to sign transactions on their behalf. The discrepancy between the exchange's containment claim and continued draining matters because it questions how completely the breach was scoped and whether more addresses were exposed than initially disclosed. Watch for Mercado Bitcoin's reconciliation of the $36.3 million figure against Bitquery's $48.6 million cross-chain tally, and for confirmation of how the signing authority was compromised.