Mercado Bitcoin $48.6M Hack: 36,042 Deposit Addresses Swept

TL;DR

On November 2, 2026, an attacker took $48.6M from Mercado Bitcoin across 10 blockchains, by Bitquery's count, emptying the Brazilian exchange's hot wallets in about 25 minutes. Mercado Bitcoin said at 12:56 UTC that it had contained the incident. Bitquery's trace shows 36,042 customer deposit addresses on Ethereum paying the attacker from 12:27 to 16:56 UTC, four hours past that statement, with a BNB Chain sweep running later still. The same attacker address had started on wallets tied to BitMart 53 minutes before the main drain, and BitMart's founder has since confirmed a breach. No root cause is public. An exchange can switch off its platform in minutes, but a signing key keeps working until every address it controls is empty.

What Happened at Mercado Bitcoin on November 2?

Mercado Bitcoin, one of Brazil's largest exchanges, lost the contents of its hot wallets overnight and took the platform down. Hypernative raised the first public alarm, flagging more than $40 million in transfers from wallets attributed to the exchange to newly created addresses on at least ten networks. Hypernative put the largest moves between 06:19 and 06:53 UTC, with earlier activity on Bitcoin deposit addresses from 02:15 UTC. Bitquery's later trace puts the main burst at 25 minutes, with hot wallets on all 10 chains paying inside it.

Hypernative's observation about the shape of those transfers is the important one. No smart contract was exploited. They were ordinary sends, signed as if the source wallets had authorized them.

The exchange's statement on X, timestamped 12:56 UTC, said it had identified and quickly contained an incident in one of its systems, with no customer losses and no customer data leak, and that deposits and withdrawals were suspended as a precaution. It then published the destination addresses for each chain.

How Much Was Taken, and Which Number Should You Trust?

Four figures are circulating, and three of them describe the same thing at different moments.

Figure	Source	What it measures
$40M+	Hypernative	First-hours estimate, pending confirmation that every source wallet belonged to the exchange
About $49M	Mercado Bitcoin via Valor Investe, and Chainalysis	Gross assets involved, with $11.2M blocked at that update
About $38M	Mercado Bitcoin via CNN Brasil	Assets "still involved" at the same update
$36.3M	Exame	The exchange's number a day later, with $12.9M blocked

Bitquery writes that the exchange has not said how it reached $38M. The arithmetic suggests an answer: $38M plus the $11.2M blocked is $49.2M, and $36.3M plus the $12.9M blocked is also $49.2M. On our reading, those are net figures that fall as freezes rise. Mercado Bitcoin has not confirmed this.

We use Bitquery's $48.6M as the headline because it is gross, chain-by-chain and valued at transfer time, and because it agrees with both Chainalysis and the exchange's own gross number. It carries one soft spot that Bitquery discloses: $1.21M of it is a token called EVA on Arbitrum that trades less than that in a week. Strip it out and the total is $47.4M.

The Attack, Step by Step

Times are UTC. Unless noted, on-chain events are from Bitquery's trace, read at 10:02 UTC on November 4.

When	Event
Nov 1, evening	The attacker's Ethereum address receives its first coins, and the Tron address follows minutes later.
Nov 2, 02:15	Bitcoin deposit addresses attributed to the exchange start paying one attacker wallet (Hypernative)
53 min before the main drain	The same EVM address starts taking funds from wallets on Base, Arbitrum and Optimism, nearly all tied to BitMart
06:24:23	The Ethereum hot wallet sends 0.0001 ETH to the attacker
06:24:47	24 seconds later, the same wallet sends 2,852.07 ETH, then 187 tokens in 24 minutes, down to scraps worth a few dollars
Within 25 minutes	Hot wallets on all 10 chains have paid the attacker, using one address per chain
06:48 to 12:07	Ethereum funds sit still for about five hours
10:21	Tether makes the first issuer freeze, on Polygon
12:27	Deposit addresses on Ethereum start paying the attacker, each signing its own transfer
12:56	Mercado Bitcoin says the incident was contained
14:26	A second deposit sweep starts on BNB Chain, reaching 143 addresses
16:19	Circle's first freeze, six hours after Tether's
16:56	The Ethereum sweep ends at 36,042 addresses, worth $266K
20:19 to 20:44	About 1,400 Base deposit addresses pay the attacker a few dollars of ETH each. None of those checked belongs to Mercado Bitcoin
Nov 3 to 4	136 tokens worth about $11.9M are sold for ETH through MetaMask's swap service

We checked the load-bearing rows ourselves. On Blockscout, native-ETH payments from deposit addresses ran well past the statement, and among the last of any size, one landed at 16:54:47 UTC. That read covers native sends only, so it cannot reproduce the 36,042 count, which includes token transfers. It does confirm the window.

Why Did Deposit Addresses Keep Paying After the Statement?

The addresses sat outside everything the exchange switched off.

An exchange gives each user a deposit address per chain, then sweeps those balances into a hot wallet that funds withdrawals. Bitquery notes that exchanges usually derive every deposit key from one master key, the hierarchical scheme defined in BIP-32. One seed yields millions of child keys, which is convenient for the operator and total for whoever obtains it.

Bitquery's reading is that the attacker can sign for those addresses, and the evidence fits. Each address signed its own payment. In Bitquery's random sample, every address with prior history had paid only the exchange's hot wallets. About 91% held less than $10. Later in the sweep the attacker used deposit addresses that still held ETH to pay gas for others, so their tokens could be taken too.

The $266K is small next to the hot wallets. A busy exchange-linked wallet on BNB Chain sent the attacker $124K by 18:08 UTC, more than five hours after the statement. And because the keys cannot be un-leaked, any coin sent to an old deposit address could have been taken, which is why the deposit pause mattered more than it looked at 12:56.

Bitquery also found that the large Bitcoin payment looks like the exchange's normal payouts, while the deposit sweeps used different software and paid far higher fees. That fits an intruder with access to the payout system plus separate possession of deposit keys. The chain alone cannot prove it, and Mercado Bitcoin has not said how the attacker got in.

The attacker waited more than five hours between finishing the Ethereum hot wallet and starting on Ethereum deposit addresses. Those 36,042 addresses still held funds at 12:27, so no defensive sweep had reached them by then. We cannot tell whether one was attempted, or was safe to run with the signing path in doubt.

What Does BitMart Have to Do With It?

The same attacker address took funds from wallets tied to BitMart first. Bitquery's report counts $298K on Base, Arbitrum and Optimism before the main drain, and about $391K in all. Its labels mark the Arbitrum and Optimism wallets as BitMart hot wallets, while the Base wallet attribution rests on 2024 test payments with a wallet in BitMart's proof of reserves.

On November 3, founder Sheldon Xia replied on X: "Yes, we got hacked yesterday too." He called the amount small, said early findings point to the Mercado Bitcoin attackers, and said restructuring had left only a core team. BitMart has not published a loss figure or confirmed ownership of every wallet Bitquery named.

That evening about 1,400 Base deposit addresses paid the attacker in the same sweep pattern, and some had paid the BitMart-tied Base wallet in earlier years. If those wallets are BitMart's, one attacker held signing ability at two exchanges on one night. Bitquery suggests looking at a shared supplier, such as a firm that runs wallets for both. Nothing public confirms that lead, but it is the first question we would ask on similar custody tooling.

The sources we reviewed attribute this attacker to nobody. It came four days after the Binance theft, and they do not connect the two.

Who Froze What, and How Fast?

Issuers froze $11.8M by Bitquery's count, and Mercado Bitcoin's own running total has since passed $15M. The speed varied a great deal.

Issuer	Frozen	First action (UTC)
Tether	$5.9M on four chains	10:21, Polygon
Circle	$4.3M in USDC and EURC	16:19, finishing November 4
Paxos	$1.5M in PAXG and USDP	A few hours after Tether
Agora, Ripple	$145K combined	That afternoon

Circle's first EURC freeze on Ethereum named a new wallet holding no EURC, and about $400K at the attacker's main address stayed free until November 4. And on Solana, the attacker sold tokens into a USDT account right up to Tether's freeze, with the last sale landing one second before it. Synthetix went further than a freeze and pulled $76K of SNX back out of the attacker's address.

Where Is the Money Now?

Mostly still in the attacker's wallets. At Bitquery's last read, the attacker held 8,678 ETH, about $20.1M, across ten wallets, and had reached no exchange deposit that Bitquery could see.

The Bitcoin has not moved. The address Mercado Bitcoin published has received 106.07 BTC and spent none, which we confirmed on November 5.

The exchange says customers will not lose assets. It plans to cover the shortfall from its own funds, and read-only website access returns on November 9, with transfers, withdrawals and trading to follow after security checks. It disclosed a recent $20M investment from Tether and says its desk is preparing to buy back the assets. That is a promise about the firm's balance sheet, and the chain cannot verify it.

Why Is "Contained" the Wrong Word for a Key Compromise?

Containment describes an intruder's access to a system, and a key held elsewhere is unaffected by it.

Taking the platform offline stops your own withdrawal queue. It does nothing to a private key held elsewhere, because an EOA has no pause function and no administrator. Every address under that key stays spendable, at the attacker's pace, until it is empty or until the coins inside have been moved by someone who signs faster. We documented a version of this in September: Bitget detected the first signals, and by our timeline $290.4M of its $387.5M still left after that alert.

Stopping the intrusion and neutralizing every key it touched happen at different times. Public statements usually report the first and are read as the second.

No contract failed at Mercado Bitcoin, so a clean audit report would have changed nothing about who could sign.

What Should Exchange Operators Do Now?

Treat the deposit tree as compromised with the hot wallet. If any signer or seed is in doubt, assume every derived address is spendable by the attacker until you have proved otherwise.
Rehearse an emergency sweep. Decide in advance how you move deposit balances to a clean address when the normal signer cannot be trusted. Here, more than five hours passed between the Ethereum hot wallet running dry at 06:48 and the first Ethereum deposit sweep at 12:27.
Stop deposits to old addresses immediately, and say why. The pause was correct. Pair it with a plain warning that previously issued addresses are unsafe.
Split key material. Separate seeds for deposits and payouts, and per chain where tooling allows, so one compromise does not hand over both.
Alert on the deposit address that pays anyone else. A deposit address has one legitimate destination. A single send anywhere else is a high-confidence signal with almost no noise.
Pre-wire issuer contacts. Six hours separated the first Tether and Circle actions here. Keep named contacts, a template with exact addresses and token contracts per chain, and a check that each request names the wallet that actually holds the asset.
Ask your custody and wallet vendors the shared-supplier question now. If you use the same tooling as an affected exchange, you want that answer before the root cause is published.
Report gross and net separately. A falling "still involved" number reads as a smaller hack. Publish what left, then what has been recovered.

Where Would Detection and Testing Have Mattered?

The transfers here came from EOAs, so nothing could pause them on-chain and no alert stops the first signed send. What alerting changes is everything after it, and this attack left a readable trail. Bitcoin deposit addresses began paying one wallet about four hours before the main drain. A 0.0001 ETH test went to a fresh address 24 seconds before 2,852 ETH followed it. Hot wallets on 10 chains paid the attacker inside 25 minutes. One wallet sent 187 tokens in 24 minutes, including dust no treasury operation would bother moving. Then deposit addresses that had only ever paid the exchange began paying a stranger. Any one of those is a rule, and the last one sat in front of more than four hours of sweeping.

Two moments decided this outcome, and we work on both. The first is the route to whatever can request a signature, which our penetration testing attacks across APIs, cloud infrastructure and operational security before an intruder does. The second is the hours after the first transfer, the stretch from 06:48 to 12:27 here. Our incident response team spends those hours triaging ongoing risk, tracing funds across chains and coordinating freezes.

Frequently Asked Questions

Was Mercado Bitcoin hacked?

Yes. The exchange confirmed a security incident in one of its systems on November 2, 2026, and suspended deposits and withdrawals. Its hot wallets on 10 blockchains paid an attacker within about 25 minutes.

How much did Mercado Bitcoin lose?

About $48.6M left its wallets, by Bitquery's count at transfer-time prices, or $47.4M without one illiquid token. The exchange's lower figures of $38M and $36.3M appear to be net of freezes, and more than $15M has now been blocked.

Was the attack really over at 12:56 UTC?

No. Deposit addresses on Ethereum kept paying the attacker until 16:56 UTC. A BNB Chain sweep started at 14:26 UTC, and one exchange-linked wallet there had sent $124K by 18:08 UTC.

Is the BitMart breach connected?

Undecided. The same attacker address received the funds, and BitMart's founder said early findings point to the same group, but BitMart has not confirmed every wallet Bitquery attributed to it and neither exchange has published a root cause.

Mercado Bitcoin's $48.6M Hack: 'Contained' at 12:56 UTC, Still Sweeping Deposits at 16:56