Hackers continued stealing funds from Brazilian crypto exchange Mercado Bitcoin for roughly four hours after the company said it had contained the cyberattack, according to blockchain data.

The attacker drained 36,042 customer deposit addresses on Ethereum between 12:27 and 16:56 UTC on Nov. 2, despite the exchange saying that day at 12:56 UTC that the breach had been contained, according to blockchain data platform Bitquery.

The findings cast doubt on how fast Mercado Bitcoin brought the attack under control and suggest the hacker gained access to systems used to manage customer deposits.