Mercado Bitcoin Hack Hits $48.5M, Bitquery Finds

Bitquery traces Mercado Bitcoin deposit-address sweeps

Bitquery’s investigation counted 35,853 Ethereum deposit addresses emptied, worth about $261,000, with activity continuing through at least 15:44 UTC after the exchange’s 12:56 UTC containment statement. Addresses are not unique customers.

Its data snapshot covers November 2, with Ethereum checked at 15:46 UTC and other chains between 14:16 and 15:47 UTC. The estimate excludes unpriced tokens; removing an illiquid EVA holding reduces it to $47.2 million. Some source-wallet attribution relies on behavior rather than public labels. Daily Crypto Briefs has not independently reproduced the full calculation.

Earlier, Hypernative flagged more than $40 million in suspicious transfers, according to Unchained’s report carried by Yahoo Finance. Its preliminary breakdown included roughly 106 BTC, 2,852 ETH, 10,700 SOL and 6.7 million XLM, alongside other tokens.

That report placed the largest transfer wave between 06:19 and 06:53 UTC, after earlier Bitcoin sweeps. It described ordinary signed transactions and said how signing access was obtained remained unclear. Network acceptance of a signature establishes transaction authorization at the cryptographic level, not the human identity behind it.

An exchange deposit address is a destination customers use to fund an account. A customer can have multiple addresses, and a balance previously credited inside the platform can differ from coins remaining at that address. Consequently, an address sweep alone cannot establish a person’s final account loss.

Mercado Bitcoin reports $11.2M blocked after attack

Mercado Bitcoin told CNN Brasil it was working with issuers and recovery partners, including Tether, Circle, BRL1, Paxos and Chainalysis. It said additional assets capable of being blocked had been identified and that customers would not lose their assets.

The later company statement followed an earlier issuer intervention. Decrypt reported that Tether Chief Executive Paolo Ardoino said more than 4.5 million USDT had been frozen in connection with the incident.

A freeze restricts the ability to move a token. Returning it can require further issuer action and legal or operational steps. The earlier issuer figure should therefore not be added to the exchange’s later aggregate as if it represented a separate recovery.

A complete reconciliation would distinguish the amount removed, subsequent price changes, assets immobilized and assets actually returned. Without that accounting, subtracting every published freeze from every published theft estimate could produce a misleading remaining-loss figure.

The distinction also featured in Binance’s post-hack reserve disclosures. Replacing backing, proving a dated balance and retrieving stolen assets answer separate questions, even when each supports an exchange’s response.

Mercado Bitcoin’s assurance about customer balances, also reported by Folha, remains the company’s position. It does not independently establish the final cost to the business, the source of replacement assets or the time required to restore every transfer route.

Mercado Bitcoin status page leaves withdrawal question open

At 05:03 UTC on November 3, the exchange’s public status page displayed its website, registration, trading interface service, mobile app and login as operational. Crypto deposits and withdrawals were not separately listed, so that display alone does not confirm their resumption.

CNN Brasil reported that Mercado Bitcoin would announce a reopening timetable through official channels. Its statement also warned that it does not request passwords, verification codes or recovery phrases, or offer reimbursements through unsolicited links, WhatsApp or calls.

That warning is relevant while customers await access information. A functioning website and a convincing support message cannot establish that a particular transfer destination or reimbursement request is authorized.

The recent BTCPay Server wallet-drain investigation concerned a different system. Similar timing across incidents supplies no evidence of a shared attacker or vulnerability; Mercado Bitcoin’s technical entry point remained undisclosed in the reviewed statements.

Alternative.me’s Fear & Greed Index read 26, or Fear, compared with 37 the previous day. The market-wide gauge measures sentiment and cannot assess this exchange’s solvency.

The next substantive disclosures are a confirmed withdrawal timetable, a technical explanation and a reconciled recovery account. Until then, the investigation establishes observed asset movements while the ultimate financial impact remains unsettled.