Bitquery says an attacker kept draining Mercado Bitcoin-linked deposit addresses after the Brazilian exchange announced on November 2, 2026, that it had contained a security breach. Its analysis says 36,042 Ethereum customer deposit addresses, holding about $266,000, were emptied from 9:27 a.m. to 1:56 p.m. Brazil time; the exchange made its announcement at 9:56 a.m. Bitquery says the transfers suggest the attacker had access to the addresses’ private keys or a system that could authorize transfers, and warned that other addresses may still be at risk.
Bitquery estimates $48.6 million was stolen across 11 blockchains, while Mercado Bitcoin puts affected assets at about $36.3 million. The exchange has not publicly explained the later transfers and says it will cover user losses with its own funds. It plans to restore balance viewing on November 9, but deposits, withdrawals and trading have no restart date.
