Blockchain analysis shows $48.6 million moved across 11 chains after Mercado Bitcoin said it stopped the breach on Nov 2, 2026.

On November 2, 2026, Mercado Bitcoin – Brazil’s largest crypto exchange – announced that it had contained a security breach. New forensic research from blockchain analytics firm Bitquery, however, shows that the attacker continued moving funds for nearly four hours after the public statement, shifting more than $48 million across eleven different networks.

How the breach unfolded on the blockchain

Bitquery’s updated analysis, released on Thursday, November 5, 2026, identified 36,042 Ethereum deposit addresses that were drained between 9:27 a.m. and 1:56 p.m. Brazil time on the day of the incident. Those addresses held roughly $266,000, a tiny slice of the total loss but a clear indicator that the attacker retained private‑key access after the exchange’s containment claim.

The stolen assets were not limited to Ethereum. The firm tracked $48.6 million moving through eleven blockchains, including Bitcoin, Binance Smart Chain and others. This figure exceeds Mercado Bitcoin’s own estimate of $36.3 million, highlighting a sizable gap between the exchange’s internal accounting and the public forensic data.

Why the containment claim is questionable

When an exchange says a breach is contained, it usually means the malicious actor’s access to critical systems has been revoked. In this case, the continued withdrawals suggest the attacker either possessed the private keys for each deposit address or controlled a signing system that could authorize transactions on behalf of the exchange.

Most exchanges generate deposit keys from a single master key. If the attacker compromised that master, they could potentially reach any customer address, even those not yet emptied. Bitquery warned that re‑using old deposit addresses could expose users to further loss until the exchange confirms the keys are safe.

Read also: Solana Leap launches mobile app for tokenized stocks and crypto

Impact on customers and the exchange’s response

Mercado Bitcoin reassured users that it would cover the losses with its own funds, but its public communications have not explained why the breach continued after the announced containment. The exchange plans to reopen account‑viewing functions on November 9, 2026, while keeping deposits, withdrawals and trading suspended pending a full security review.

For traders, the incident underscores the importance of using fresh deposit addresses and monitoring on‑chain activity. The lack of a clear timeline for when full services will resume adds uncertainty to the market, especially for Brazilian investors who hold a significant portion of their crypto on the platform.

What to watch next

Analysts will be looking for further updates from Mercado Bitcoin on the remediation plan, especially any confirmation that the master signing key has been rotated. Additional blockchain scans may reveal whether the attacker moved the $48.6 million into mixers or centralized exchanges, which could affect the recoverability of the funds.

Regulators in Brazil are also expected to increase scrutiny of crypto‑exchange security practices after this high‑profile breach. Any new guidance or enforcement action could shape how other regional platforms manage deposit keys and hot‑wallet operations.

• Nov 2, 2026 – Mercado Bitcoin announces containment of breach
• Nov 5, 2026 – Bitquery releases forensic report showing $48.6 million moved
• Nov 9, 2026 – Exchange plans to restore account‑viewing feature

Frequently asked questions

Related news

• Solana Leap launches mobile app for tokenized stocks and crypto
• Democrats sweep makes crypto policy defensive in Washington
• Market overview: pound climbs, gold recovers and bitcoin steadies
• Polygon hard fork aims to recover stolen POL tokens

More from ITF

• Copy verified traders with ITF Copy Trading

This article is compiled from international market news for information only. It is not investment advice.