Bitquery has debunked Mercado Bitcoin’s claim that the situation was already under control.
At 9:56 a.m. Brazil time on November 2, the exchange said it had contained the incident. But on-chain data shows that 36,042 Ethereum deposit addresses were drained from 9:27 a.m. to 1:56 p.m.—nearly four hours after the announcement. Moving those funds would have required either the private keys to the deposit addresses or access to a system that could sign transactions on their behalf.
The amounts don’t add up either: the exchange’s FAQ says about $36.3 million was affected, while Bitquery traced $48.6 million across 11 chains—a $12.3 million difference. Don’t use old deposit addresses for now. This isn’t a warning; it’s what the evidence points to.
At 9:56 a.m. Brazil time on November 2, the exchange said it had contained the incident. But on-chain data shows that 36,042 Ethereum deposit addresses were drained from 9:27 a.m. to 1:56 p.m.—nearly four hours after the announcement. Moving those funds would have required either the private keys to the deposit addresses or access to a system that could sign transactions on their behalf.
The amounts don’t add up either: the exchange’s FAQ says about $36.3 million was affected, while Bitquery traced $48.6 million across 11 chains—a $12.3 million difference. Don’t use old deposit addresses for now. This isn’t a warning; it’s what the evidence points to.