Mercado Bitcoin told customers their funds and data were safe. On-chain analysts watched wallets tied to the exchange keep moving for hours after deposits and withdrawals were suspended.
The company statement and the chain are answering different questions.
In this article
Why this matters
A withdrawal pause is a user-facing action. It does not immobilize keys, signing sessions or deposit addresses. If an attacker has signing authority, the pause can arrive after the money has already moved — which is what the reported timeline shows.
The customer-facing detail is the one that changes the blast radius. Analysts traced small transfers from 27,160 distinct addresses that appear to be customer deposit addresses, and 19 of 20 sampled had previously forwarded deposits to the same Mercado Bitcoin collector wallet. That is a different problem from a compromised treasury wallet.
Both the company statement and the on-chain record can be true at the same time. The exchange can say customers lost nothing while the chain shows wallets moving after the pause. The record does not reconcile the two, and “no customer losses” is not the same as “no movement.”
For exchanges and custodians, the operational lesson is to pair a pause with key-level containment: rotate exposed keys, revoke signing sessions, change multisig thresholds, replace deposit addresses and verify that the signing service enforces policy.
What happened
Mercado Bitcoin confirmed a security incident, temporarily suspended deposits and withdrawals, and said customer funds and data were safe. A spokesperson said customers had suffered no losses and no data had leaked. The exchange did not respond to questions about transfers that continued after the suspension (Cointelegraph).
Blockchain analysts estimated the drain at more than $46 million. CertiK senior security engineer Dickson Wu traced activity across 17 chains and put the loss at about $49 million at 06:30 UTC prices on 2 November: Ethereum $29.6 million, Bitcoin $8.3 million, Solana $3.5 million, Stellar $2.1 million, Arbitrum $1.7 million, Polygon $1.7 million, Tron $1.5 million, Avalanche $660,000, and nine additional chains $250,000. Four thinly traded tokens worth roughly $3.5 million were included in that total; excluding them gives about $46 million (Dickson Wu).
The reported sequence began at 01:22 UTC with a 0.0001 ETH test from Mercado Bitcoin’s Base hot wallet, followed three minutes later by 21.26 ETH. Between 01:26 and 05:10, the activity touched Optimism, Arbitrum, Cronos, Linea, Scroll, Flare and Mantle, moving about $284,000. The main drain ran from 05:42 to 06:49 across Bitcoin, Ethereum, Tron, Stellar, Solana, Avalanche, Polygon, XDC, BNB Chain and Arbitrum, moving $48.9 million (Dickson Wu).
At 06:24, 2,852 ETH left the main Ethereum hot wallet, followed by roughly 190 tokens over the next 24 minutes. At 06:41, a single Bitcoin transaction moved 104.43 BTC by spending 34 inputs. Between 06:47:50 and 06:48:31, Avalanche, Polygon, Arbitrum and XDC were drained within 41 seconds; BNB Chain was last at 06:49. At 12:07, 2,800 ETH moved to a newly created wallet. Mercado Bitcoin’s first public post appeared at 12:56.
The part that changes the picture
Beginning at 12:27 UTC, 27,160 distinct addresses each sent a small amount of ETH to the attacker over 56 minutes: a median of 0.00025 ETH and a total of 34.7 ETH. Wu sampled 20 of those addresses; all had been in use before Sunday, and 19 had previously forwarded deposits to the same Mercado Bitcoin collector wallet (Dickson Wu).
At 14:03, a second drain moved $82,000 of USDT and USDC from 776 addresses, with most of the USDT going to an address Tether had already frozen (Dickson Wu).
If the same signing authority could move funds from individually assigned deposit addresses, the blast radius is not limited to the treasury wallets the exchange operates. The record does not establish whether all 27,160 addresses were customer deposit addresses, whether the attacker used a shared key, a compromised collector or a common signing service, or whether some transfers were voluntary withdrawals that were mischaracterized.
What the company said, and what the chain shows
The company confirmed the incident, paused deposits and withdrawals, and said customer funds and data were safe. It did not comment on the transfers that continued after the suspension.
The on-chain record shows movement after that pause, continued inflows to addresses tied to the incident, and small transfers from thousands of deposit addresses. Tether and Circle froze approximately $6.2 million by 16:42 UTC; the exchange published a list of associated addresses, and all 106 BTC remained on those addresses as of publication (Cointelegraph).
What to do
Treat a pause as communication, not containment. Rotate exposed keys, revoke signing sessions, change multisig thresholds, replace deposit addresses and verify that the signing service enforces destination and amount policy.
Monitor the deposit path, not only the treasury. If customer deposit addresses share a collector or signing authority, a hot-wallet check is incomplete. Map how deposit addresses are derived, who can move from them, and how they are monitored.
Reconcile statements with the chain. “No customer losses” and “no movement” are different claims. Publish the address list, the freeze status and the reconciliation so customers can verify what happened to their funds.
Preserve the evidence. Key-management logs, signing-service logs, session records and deposit-address mappings are the evidence that shows whether the pause actually stopped anything.
For customers, watch the addresses you used to deposit, check issuer freeze lists, and do not assume a withdrawal pause means the wallets stopped moving.
What remains unproven
- Initial access and attribution. Compromised credentials, stolen keys, insider access and a compromised signing service are all consistent with the observed behaviour; none is documented. Wu’s dust lead from 1 November is a lead for investigators, not proof of the path.
- The deposit-address claim. The record does not establish that all 27,160 addresses were customer deposit addresses, or that the same signing authority controlled them.
- The exact loss. The estimate ranges from about $46 million to about $49 million, and the frozen, fresh-wallet and remaining-address categories are not reconciled into an audited total.
- Customer losses and data exposure. The company says there were none; the public record does not independently verify that.
- Post-pause transfers. The record does not establish whether they were attacker movement, exchange movement or customer withdrawals.
- Recovery. All 106 BTC remained on the listed addresses as of publication.
Method and sources
This analysis draws on Cointelegraph’s reporting and Dickson Wu’s public on-chain trace, including the explorer links he published. The company statement is identified as a company statement. The on-chain analysis is third-party work and was not independently verified here; where the record is incomplete, this article says so rather than filling the gap.