WORLDTECHMercado Bitcoin's Containment Claim Contested by Blockchain Data
Bitquery says an attacker kept draining Mercado Bitcoin-linked deposit addresses for nearly four hours after the Brazilian exchange said it had contained a security breach, a finding that challenges the exchange's account of a quick response.
Scale of the stolen assets
Bitquery's analysis, updated on Thursday, traces more than $48 million in stolen assets across 11 blockchains. The researchers put the total at $48.6 million, above the exchange's latest estimate of $36.3 million. Bitquery says 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and later in the attack window.
How the withdrawals were authorized
A customer deposit address works much like a personal receiving account for cryptocurrency, and exchanges usually gather those balances into a shared hot wallet for everyday transactions. Moving funds out of such an address requires its private key, the secret that authorizes transfers. According to Bitquery, the withdrawals were authorized directly by the deposit addresses, which suggests the attacker either held those keys or controlled a system able to sign transactions on their behalf.
The researchers cautioned that exchanges commonly generate deposit keys from one master key, so the attacker may still be able to reach other customer addresses.
Account viewing returns before trading
Mercado Bitcoin plans to reopen account viewing on November 9, while withdrawals and trading stay suspended at first. The findings bear directly on whether customers can rely on the exchange's containment account while those restrictions remain in place.
Open questions
- Has Mercado Bitcoin confirmed or disputed Bitquery's figures?
- Can the attacker still reach other customer deposit addresses?