Analysts at Bitquery report that the attacker continued to drain funds from Mercado Bitcoin deposit addresses for several hours after the exchange claimed the breach was contained. Between 12:27 and 16:56 UTC on November 2, the hacker emptied 36,042 Ethereum deposit addresses, totaling approximately $266,000.
Similar activity occurred on the BNB Chain and Base networks, with unauthorized transfers continuing for over five hours past the official announcement. Bitquery estimates the total damage from the attack at $48.6 million, covering assets stolen from wallets across 11 different blockchains, including Bitcoin, Solana, Tron, and Polygon.
The investigation suggests the attacker may have gained access to private keys or the internal signing system, as transactions were signed directly by the deposit addresses. Bitquery advises users to avoid using previous deposit addresses until the exchange confirms their security. Stablecoin issuers have frozen approximately $11.8 million of the stolen assets.
Mercado Bitcoin plans to resume platform operations on November 9, initially allowing users to view balances and transaction history. The exchange has committed to compensating affected clients using its own funds, though the timeline for restoring full trading and withdrawal functionality remains unconfirmed.
