In brief
- Bitquery says the attacker drained 36,042 Ethereum deposit addresses for nearly four hours after Mercado Bitcoin announced containment.
- The researchers tracked $48.6 million across 11 networks, above the exchange’s latest estimate of $36.3 million.
- Mercado Bitcoin plans to reopen account viewing on November 9, but withdrawals and trading will remain suspended initially.
An attacker drained Mercado Bitcoin-linked deposit addresses nearly four hours after the Brazilian exchange said it had contained a security breach, new blockchain research shows.
Bitquery’s analysis, updated Thursday, traces more than $48 million in stolen assets across 11 blockchains. Its findings challenge the exchange’s claim that it stopped the attack quickly.
The Bitcoin exchange announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time.
Those addresses held roughly $266,000, a small fraction of the total theft. But the attacker could still move those funds after the exchange’s announcement.
A customer deposit address works much like a personal receiving account for cryptocurrency.
