Mercado Bitcoin said its hack was contained. On-chain data tells a different story. According to Bitquery, the attacker continued draining customer deposit addresses for nearly four hours after the exchange's announcement. The investigation found: • 36,042 $ETH deposit addresses emptied. • $48.6 million stolen across 11 blockchains. • Around $11.8 million frozen by stablecoin issuers. That puts Bitquery's estimate above the roughly $38 million initially reported by the exchange. The most alarming detail? The attacker could sign transactions from customer deposit addresses, suggesting access to their private keys or the system managing them. Mercado $BTC says customers will be reimbursed, but withdrawals remain suspended. This incident raises a serious question about exchange security: how safe are customer funds when the platform's signing infrastructure is compromised?