$48.5M left Mercado Bitcoin's wallets on 10 blockchains. Hours after the exchange said the attack was contained, the hacker was still emptying customer deposit addresses

01 · What happenedWhat happened in the Mercado Bitcoin hack

If you use Mercado Bitcoin, you could not deposit or withdraw on Monday, 2 November. The Brazilian exchange paused both after an attack on one of its systems overnight. It said the attack was over fast. No customer, it said, would lose money.

A security firm had seen the money go. BitNotícias reported that Hypernative, which watches blockchains for hacks, flagged more than $40 million in suspicious transfers on at least ten chains. The exchange confirmed the attack on X soon after midday UTC.

Bitquery records every transfer on these chains, so we followed the money from the exchange's wallets to the hacker's, chain by chain, as it moved. We count $48.5M taken on 10 chains, valued at the time. We also found that the hacker can sign for the addresses users pay into. On Ethereum it emptied 35,853 of them. It kept going for more than two hours after the exchange said the attack was over.

02 · The walletsHow an exchange holds your coins

Each user gets their own deposit address on each chain. When you send coins there, the exchange credits your account. Later it sweeps the coins into a hot wallet, an online wallet that pays out every withdrawal. The exchange holds the private keys, the secret codes that move coins, for all of them.

The hacker got at both kinds of wallet. First it took what sat in the hot wallets. Hours later it started on the deposit addresses, one by one. That needs a key for each address, or a way into the system that signs for them.

03 · The nightTen chains in less than half an hour

A few old Bitcoin addresses of the exchange were emptied late on Sunday night, Brazil time, but the main attack came after 3am. In just 25 minutes, the hot wallets on all 10 chains paid the hacker.

The hacker used one address on each chain, and the same one on all the chains that run like Ethereum. Two were ready the evening before. The Ethereum address got its first coins on the evening of 1 November, and the Tron one a few minutes later. Two small wallets that tested the Ethereum address that evening also paid the Tron one, so one person most likely set up both.

Ethereum took the biggest hit. Bitcoin came next, where most of the coins left in a single payment. The other eight chains added $10.4M between them.

04 · EthereumEthereum: 187 tokens in 24 minutes

The exchange's Ethereum hot wallet, 0x5cc7…d548, paid the hacker one token at a time. It started with 2,852 ETH. Next came USDT and USDC, the two biggest stablecoins, tokens that track the US dollar. Then it sent token after token, down to scraps worth a few dollars.

The wallet was left with almost nothing. It had been the exchange's main wallet on this chain since September, when an older hot wallet moved its tokens across. Since July it has paid out to thousands of addresses, as a busy exchange wallet does.

Then the money on Ethereum sat still. For five hours, nothing went out. The first move was to send 2,800 ETH to a new wallet, just after midday.

05 · Deposit addressesThe hacker can sign for customer deposit addresses

Minutes later, something new began. The exchange's deposit addresses on Ethereum started to send their whole balance to the hacker. Each one signed its own payment. By 15:44 UTC, 35,853 of them had done so, worth $261k in all.

The exchange posted its statement in the middle of the busiest stretch. The sweep went on. Later, the hacker even used deposit addresses that still held ETH to pay the network fees for others, so that it could take their tokens too.

These are the users' own deposit addresses. We checked a random sample. Every one that had sent money before that Monday had sent it to the exchange's own hot wallets. Most held very little. About 91% had less than $10 in them.

The dollar sum is small next to the hot wallets. It still matters. Exchanges usually make all deposit keys from one master key, so the hacker can most likely sign for any of them. That is why the pause on deposits matters. A coin sent to an old deposit address now could be taken. On Bitcoin, 53 deposit addresses were emptied as well.

06 · FreezesTether and Paxos froze $7.3M. Circle froze nothing

The firms that issue stablecoins can freeze them in any wallet. Tether moved first. It froze the hacker's USDT0 on Polygon at 10:21 UTC, then its USDT on Tron and Ethereum about an hour later. The freeze also caught 81 ounces of gold, held as Tether's gold token.

Paxos, the company behind the gold token PAXG and the dollar coin USDP, froze both a few hours later. That included 369 PAXG already moved to a new wallet. Half an hour after that, Tether froze 1.26M USDT on Solana. The hacker had spent the hour before selling Solana tokens into that account. Its last sale landed one second before the freeze. Later, Tether also froze $82k of USAT, its new dollar coin.

Circle, which issues USDC and EURC, has frozen nothing that we can see. About $4.29M of its coins are still free to move. The other 76% of the money is mostly in coins like bitcoin and ether, which no firm can freeze.

07 · The money nowWhere the $48.5M is now

None of the money has reached a crypto exchange that we can see, and most of it has not moved at all since the hacker first took it. The bitcoin, the AVAX, the XDC and the Stellar coins sit where they first landed. On Polygon the hacker has no POL to pay network fees, so its tokens there are stuck for now.

On Ethereum the hacker has been busier. By the afternoon it had moved $19.5M into ten new wallets, and by 15:46 UTC only one had sent anything on, $18 in all.

Some of the ETH it moved came from Solana. The hacker sold SOL and USDT through Mayan, a service that swaps coins between chains, and got about $1.15M of ETH back. Relay, another such service, turned down two of its orders. On Tron, the stolen TRX moved to a fresh address.

Anyone can watch these wallets with the Bitquery MCP. Their addresses are in the record at the bottom of the page.

08 · Before Mercado BitcoinThe same hacker hit other wallets first

The exchange was not the first target that night. The same address had already taken $298k from wallets on Base, Arbitrum and Optimism. That began 53 minutes before the first Mercado Bitcoin coins moved.

None of those wallets has any link to the exchange. Our address labels mark the Arbitrum one, 0xb4af…8f01, as a hot wallet of BitMart, another exchange. That wallet has made over 100,000 payments since 2022 but was nearly idle in October. The busiest Base wallet looks like an exchange wallet too, though it has no label.

We found no statement from BitMart. The wallet may be one it no longer uses. If it is BitMart's, the hacker held keys at two companies. A shared supplier, such as a firm that runs wallets for both, would then be worth a look.

09 · The claimsChecking the claims

Hypernative's early figures hold up on the chain. The total is higher. The exchange's statement is harder to square with what came after it.

10 · For usersWhat this means if you use Mercado Bitcoin

The exchange says customers will not lose money, so the loss falls on the firm itself. That is a promise about its own funds, and the chain cannot check it. Deposits and withdrawals were still paused when we last looked, on Monday afternoon.

Do not send coins to an old Mercado Bitcoin deposit address until the exchange says it is safe. Expect new ones. After hacks like this, scammers often post fake support accounts and fake refund links on X and Telegram, hoping to catch worried users. Use only the exchange's own channels.

11 · GapsWhat we could not see

We do not know how the hacker got in. The exchange has not said. The big Bitcoin payment looks just like the exchange's normal payouts, while the deposit sweeps used different software and paid far higher fees. That fits a way into the exchange's own payout system plus the deposit keys, but the chain alone cannot prove it.

The Solana, Tron and Stellar wallets carry no public label. We count them as the exchange's because they paid users until shortly before the attack and were emptied in the same 21 minutes as the rest. The Solana money also ended up with the same hacker on Ethereum, and Hypernative tied these transfers to the exchange too.

Some tokens have no market price, so they are left out. One token, EVA on Arbitrum, counts for $1.21M at its market price but trades less than that in a week. Without it, the total is $47.2M.

12 · The methodHow we traced the money

We started from the hacker's addresses in the alert and found the wallets that paid them. We checked the history of each of those wallets, then followed every large payment until it stopped moving or reached a known service such as a bridge. Spammers send fake look-alike payments to trick copy-paste, and we left those out.

We traced the Binance hack and the $106M theft from exchange accounts the same way. You can get each chain's full history as files on the Bitquery Data Store, in the Ethereum, Bitcoin, Solana, Tron and Stellar datasets.

13 · The recordThe addresses behind the Mercado Bitcoin hack

FAQ

Was Mercado Bitcoin hacked?

Yes. Mercado Bitcoin confirmed a cyberattack on one of its systems on 2 November and paused deposits and withdrawals. On-chain, its hot wallets on 10 blockchains paid a hacker within half an hour.

How much was stolen from Mercado Bitcoin?

We count $48.5M taken on 10 blockchains, valued at the time of each transfer. Most of it came from Ethereum, then Bitcoin. Hypernative's first estimate was more than $40 million.

Did Mercado Bitcoin customers lose money?

The exchange says no customer will lose money, which means it plans to cover the loss itself. The hacker did empty 35,853 customer deposit addresses on Ethereum. Coins in a deposit address are normally credited to the customer already, so that loss also falls on the exchange's promise.

What was frozen?

Tether froze $5.9M of USDT, USDT0, USAT and its gold token on Polygon, Tron, Ethereum and Solana. Paxos froze $1.5M of PAXG and USDP. Circle, the issuer of USDC, had frozen nothing by our last check.

Where is the stolen money now?

Most of it still sits in the hacker's wallets. On Ethereum, the hacker moved $19.5M into ten new wallets. Some Solana money was swapped into ETH through Mayan. We saw no deposit into a crypto exchange.

Is it safe to deposit to Mercado Bitcoin?

Wait for the exchange to say so. The hacker can sign for old deposit addresses, so coins sent there now could be taken. Use only Mercado Bitcoin's official channels, and expect new deposit addresses.