Bitquery said an attacker continued transferring assets from Mercado Bitcoin on November 2, 2026, for about four hours after the exchange announced it had contained the cyberattack. Mercado Bitcoin made that announcement at 12:56 UTC; Bitquery said unauthorized transfers continued until 16:56 UTC.
Bitquery estimated that $48.6 million was stolen across 11 blockchains, compared with Mercado Bitcoin’s earlier figure of about $38 million. The analysts said the attacker drained hot wallets and 36,042 customer deposit addresses on Ethereum, but the initial breach mechanism remained unknown. Mercado Bitcoin said users would not incur financial losses and temporarily suspended deposits and withdrawals.
