According to Bitquery’s on-chain investigation, the attacker continued withdrawing funds from customer deposit addresses at Mercado Bitcoin for about four more hours after the exchange announced it had brought the attack under control.
Findings reported by CoinDesk have raised questions about when Brazilian crypto exchange Mercado Bitcoin responded to the Nov. 2 attack. The exchange announced that the attack was under control at 3:56 p.m. Turkey time that day, while fund outflows on Ethereum continued until 7:56 p.m. Turkey time.
Blockchain data platform Bitquery reported that the attacker drained 36,042 customer deposit addresses between 3:27 p.m. and 7:56 p.m. Turkey time. This address count covers the entire attack; no separate count was provided for the four hours after the announcement that the attack was under control.
Tracked losses reached $48.6 million
Bitquery tracked $48.6 million in stolen assets across 10 blockchains. That figure is above the $40 million initially reported in connection with the incident.
Mercado Bitcoin said it would cover all user losses resulting from the attack. With help from partners including Tether, Circle, and Chainalysis, more than $15 million in assets was frozen.
When withdrawals will resume remains unclear
The exchange suspended deposits and withdrawals following the attack. Its website is scheduled to reopen in view-only mode on Nov. 9. A date for the resumption of deposit and withdrawal services has not yet been announced.
Possible link to BitMart attack under investigation
The investigation also found that, before the Mercado Bitcoin attack, funds were sent to an address controlled by the same attacker from wallets on Base, Arbitrum, and Optimism believed to belong to BitMart. Bitquery estimated the loss associated with these wallets at about $391,000; BitMart has not confirmed this amount.
Sheldon Xia, founder of BitMart, said the exchange was also attacked on Nov. 2 and that an initial investigation pointed to the group behind the Mercado Bitcoin incident. The findings raise the possibility that infrastructure used by multiple exchanges may have been accessed; how the attacks were carried out remains unclear.
Not investment advice.