Mercado deep dive: $48.5M isn’t the whole story—after the exchange said it had “contained” the incident, the hacker kept sweeping funds for more than two hours
This is a follow-up filling in the gaps left in my previous post (01:38): did the total losses climb any higher, and was there a second batch of freezes? Bitquery’s just-released, transaction-by-transaction on-chain accounting answers both questions—but the added details sting more than the numbers themselves.
First, the numbers. Bitquery counted $48.5M across 10 chains, valued at the price at the time of each transfer. Ethereum alone accounted for $29.5M (188 transactions over 24 minutes), followed by Bitcoin. To be clear about the methodology: that $48.5M includes an EVA token whose one-week trading volume was less than its market cap (about $1.21M). Excluding it brings the total to $47.2M—so compared with the roughly $46.5M in my previous post, the overall figure has only risen slightly. The genuinely new information is in the two points below.
First, the exchange’s claim that it had “迅速控制” (quickly contained the incident) doesn’t line up with the on-chain timeline. Bitquery found that the hacker didn’t just access hot wallets—they could also sign transactions from customers’ deposit addresses. On Ethereum, 35,853 deposit addresses were gradually emptied starting at 12:10 UTC, with the sweep continuing until 15:44 UTC. The exchange issued its “contained” statement at 12:56 UTC—right in the middle of the busiest part of the sweep, which continued for more than two hours afterward. Another 53 deposit addresses were emptied on Bitcoin. Bitquery’s advice is blunt: stop sending funds to old deposit addresses and wait for the exchange to provide new ones.
Second, the freeze tally also checks out. Tether froze $5.9M (USDT, USDT0, USAT, and gold tokens across Polygon, Tron, Ethereum, and Solana), while Paxos froze $1.5M (PAXG and USDP), for a total of $7.3M—about 15% of the overall amount. Circle froze nothing: $4.29M in USDC/EURC remains movable. The remaining roughly 76% consists of assets such as $BTC and $ETH , which their issuers simply can’t freeze. The good news is that most of the funds haven’t moved: the hacker’s 106.07 BTC remain untouched, and the $19.5M transferred to 10 new Ethereum wallets had barely moved by 15:46 UTC. So far, there’s no sign of funds reaching an exchange.
It’s also worth clarifying what hasn’t changed: the exchange still hasn’t confirmed the total, provided a root cause, or given a recovery timeline. Deposits and withdrawals remain suspended (Bitquery’s latest check reflected the situation on Monday afternoon; this search found no official notice that services had resumed). The claim that “the exchange will absorb the losses” is still a statement attributed to it by Bloomberg; it can’t be verified on-chain. Also, Bitquery noted that the same address received about $298,000 from several unrelated wallets 53 minutes before Mercado. One Arbitrum wallet was tagged as BitMart—but BitMart hasn’t commented, and that tag is Bitquery’s own, not evidence that BitMart was hacked.
My take: the key thing to remember from this round isn’t that the figure went from 46.5 to 48.5, but the gap between the words “contained” and the on-chain timeline. A statement can be issued quickly, but containment isn’t complete until control over the signatures for deposit addresses has been regained. The next two things to watch are when the exchange provides new deposit addresses and when it resumes deposits and withdrawals.
Risk reminder: all of the above reflects on-chain tracking, not the exchange’s official loss assessment. $BTC is currently around 76994, $ETH around 2252, and $SOL around 91.92 (cross-checked against two sources at 02:41)—all within ordinary fluctuations. Don’t force a price movement narrative onto this one incident. During a developing incident, fake support accounts and fake refund links are especially likely to appear. Use only the exchange’s official channels, and don’t click “refund” links from unknown sources.
What do you think: when the exchange’s statement conflicts with the on-chain timeline, is that just a difference in reporting—or was control itself never really in place?
$BTC $ETH $SOL
#MercadoBitcoin #交易所安全 #BTC #ETH
This is a follow-up filling in the gaps left in my previous post (01:38): did the total losses climb any higher, and was there a second batch of freezes? Bitquery’s just-released, transaction-by-transaction on-chain accounting answers both questions—but the added details sting more than the numbers themselves.
First, the numbers. Bitquery counted $48.5M across 10 chains, valued at the price at the time of each transfer. Ethereum alone accounted for $29.5M (188 transactions over 24 minutes), followed by Bitcoin. To be clear about the methodology: that $48.5M includes an EVA token whose one-week trading volume was less than its market cap (about $1.21M). Excluding it brings the total to $47.2M—so compared with the roughly $46.5M in my previous post, the overall figure has only risen slightly. The genuinely new information is in the two points below.
First, the exchange’s claim that it had “迅速控制” (quickly contained the incident) doesn’t line up with the on-chain timeline. Bitquery found that the hacker didn’t just access hot wallets—they could also sign transactions from customers’ deposit addresses. On Ethereum, 35,853 deposit addresses were gradually emptied starting at 12:10 UTC, with the sweep continuing until 15:44 UTC. The exchange issued its “contained” statement at 12:56 UTC—right in the middle of the busiest part of the sweep, which continued for more than two hours afterward. Another 53 deposit addresses were emptied on Bitcoin. Bitquery’s advice is blunt: stop sending funds to old deposit addresses and wait for the exchange to provide new ones.
Second, the freeze tally also checks out. Tether froze $5.9M (USDT, USDT0, USAT, and gold tokens across Polygon, Tron, Ethereum, and Solana), while Paxos froze $1.5M (PAXG and USDP), for a total of $7.3M—about 15% of the overall amount. Circle froze nothing: $4.29M in USDC/EURC remains movable. The remaining roughly 76% consists of assets such as $BTC and $ETH , which their issuers simply can’t freeze. The good news is that most of the funds haven’t moved: the hacker’s 106.07 BTC remain untouched, and the $19.5M transferred to 10 new Ethereum wallets had barely moved by 15:46 UTC. So far, there’s no sign of funds reaching an exchange.
It’s also worth clarifying what hasn’t changed: the exchange still hasn’t confirmed the total, provided a root cause, or given a recovery timeline. Deposits and withdrawals remain suspended (Bitquery’s latest check reflected the situation on Monday afternoon; this search found no official notice that services had resumed). The claim that “the exchange will absorb the losses” is still a statement attributed to it by Bloomberg; it can’t be verified on-chain. Also, Bitquery noted that the same address received about $298,000 from several unrelated wallets 53 minutes before Mercado. One Arbitrum wallet was tagged as BitMart—but BitMart hasn’t commented, and that tag is Bitquery’s own, not evidence that BitMart was hacked.
My take: the key thing to remember from this round isn’t that the figure went from 46.5 to 48.5, but the gap between the words “contained” and the on-chain timeline. A statement can be issued quickly, but containment isn’t complete until control over the signatures for deposit addresses has been regained. The next two things to watch are when the exchange provides new deposit addresses and when it resumes deposits and withdrawals.
Risk reminder: all of the above reflects on-chain tracking, not the exchange’s official loss assessment. $BTC is currently around 76994, $ETH around 2252, and $SOL around 91.92 (cross-checked against two sources at 02:41)—all within ordinary fluctuations. Don’t force a price movement narrative onto this one incident. During a developing incident, fake support accounts and fake refund links are especially likely to appear. Use only the exchange’s official channels, and don’t click “refund” links from unknown sources.
What do you think: when the exchange’s statement conflicts with the on-chain timeline, is that just a difference in reporting—or was control itself never really in place?
$BTC $ETH $SOL
#MercadoBitcoin #交易所安全 #BTC #ETH
