Mercado 
Bitcoin market price and chart’s account of its November 2 security breach leaves a critical distinction unresolved: when the exchange said it had contained the incident, had the attacker stopped controlling the systems involved, or had unauthorized transfers merely been identified and restricted? A comparison of the exchange’s own notices, a published Chainalysis response and Bitquery’s updated transaction analysis shows why those are not the same question.
In a November 2 customer notice, Mercado Bitcoin said it had quickly identified and contained a security incident, suspended deposits and withdrawals and found no customer losses or data leak. Bitquery’s updated on-chain investigation, however, records transfers from customer deposit addresses until 16:56 UTC, nearly four hours after the exchange’s statement at 12:56 UTC. The analysis raises questions about the scope and timing of containment, but it does not by itself establish that the exchange knowingly made a false statement.
The Statement and the Transactions Tell Different Timelines
The exchange’s initial notice said the incident affected one of its systems, had been contained quickly and had not exposed customer information. Deposits and withdrawals were suspended as a precaution. By its separate 9 p.m. Brazil-time update, Mercado Bitcoin explained that the incident had affected its online, or hot, wallets rather than its offline reserves, and guaranteed customers would not lose assets.
That later notice estimated approximately $11 million had been blocked through coordination with issuers and investigators, while about $38 million remained unblocked. It listed 
Tether market price and chart, Circle, BRL1, Paxos and Chainalysis among partners assisting recovery. These are the exchange’s figures, not an independently audited balance sheet or a confirmed final loss.
Bitquery’s November 3 revision describes a different, transaction-based timeline. Its researchers counted approximately $48.6 million moved from wallets attributed to Mercado Bitcoin on ten blockchains, valued at the time of the transfers. They say the main hot-wallet drain happened in a roughly 25-minute window on November 2. A separate wave then targeted addresses normally used to receive customer deposits.
On 
Ethereum market price and chart alone, Bitquery identified 36,042 deposit addresses that sent balances to the attacker between 12:27 and 16:56 UTC. Its report valued those sweeps at about $266,000, much less than the hot-wallet losses. The address count matters less for the amount than for the apparent breadth of signing access: individual deposit addresses, not merely a central treasury wallet, were involved. The exact mechanism remains unknown.
What Does Contained Mean When Transfers Continue?
A cryptocurrency exchange can detect a compromise, shut down public withdrawals and isolate an affected system while an attacker still holds credentials or signing authority over previously generated addresses. Bitquery’s observations are consistent with a need to investigate that possibility. They do not prove what internal controls were active at Mercado Bitcoin or when administrators revoked access.
The on-chain report says the attackers were able to sign transactions from many customer-facing deposit addresses. That could indicate exposure of multiple keys or of a system capable of authorizing transfers. The blockchain cannot identify which internal service or employee credential, if any, was compromised. Neither the exchange’s public notices nor the cited analysis establishes a definitive initial entry point.
Bitquery also corrected its own first findings. Earlier figures included some lookalike spam addresses and missed activity on 
BNB market price and chart Chain. Its revised Ethereum count of 36,042, and the later 16:56 UTC endpoint, supersede the earlier 35,853-address figure. This matters because any defensible investigation must identify the observation window and distinguish confirmed ledger transfers from uncertain attribution.
Why Researchers Give Different Loss and Recovery Figures
Chainalysis said on November 2 that an estimated $49 million had been stolen and that assets moved across 17 blockchains. It described a call from a Mercado Bitcoin director at 2:30 a.m. Eastern Time, followed by coordination with law enforcement and stablecoin issuers to identify and freeze assets. Its public post said roughly $9 million had been frozen at the stage it described.
Bitquery attributed approximately $48.6 million to Mercado Bitcoin’s wallets on ten chains. It also observed activity at the attacker-linked address on other networks, some connected by its labels to wallets outside Mercado Bitcoin. Those additional chains should not automatically be counted as ten more Mercado Bitcoin attack chains. Neither the attribution of unrelated wallets nor the possibility of a shared service-provider compromise has been confirmed by the named firms.
By November 3, Bitquery put issuer freezes at approximately $11.4 million, including action by Tether, Circle, Paxos and smaller issuers. Mercado Bitcoin had separately rounded its blocked amount to about $11 million. Differences across the reports may reflect evolving freezes, asset pricing, chain coverage and different classification methods. They are not evidence that any single figure represents recovered cash already returned to customers.
Issuer freezes stop particular tokens from transferring, but do not automatically restore them to the exchange. Bitcoin and Ether lack a central issuer capable of applying the same kind of freeze. Bitquery traced 106.07 BTC to an attacker-associated address and described further movements through Ethereum wallets and cross-chain services. These figures are snapshots, not a final accounting.
The Customer Protection Promise Is Still a Separate Test
Mercado Bitcoin’s promise that users will not lose assets is meaningful, but cannot be verified from blockchain records alone. Public transactions can show where tokens moved and whether certain balances were frozen. They cannot show the exchange’s full liabilities, off-chain reserves, insurer recoveries, capital transfers or the reconciliation of each customer’s account.
The exchange also said there had been no personal-data leak. Nothing in the cited wallet-transaction analysis independently proves or disproves that statement. A private-key or transaction-signing compromise and a leak of customer identity records are different security outcomes.
Customers should rely on the exchange’s official app and support channels for reopening instructions. Its November 2 update warned that it does not seek passwords, verification codes or recovery phrases over messages, calls or refund links. Because deposit-address control remains part of the unanswered questions, sending funds to old addresses before receiving updated official instructions carries additional uncertainty.
Five Questions the Exchange Has Not Publicly Resolved
The available material leaves five questions for Mercado Bitcoin: What did its initial containment statement refer to technically? When was signing access to deposit addresses finally revoked? Were old deposit addresses rotated across every affected network? How does the exchange reconcile its $38 million unblocked estimate with the larger transaction-based totals? And what evidence will support its commitment to cover all customer balances?
Those questions are not accusations. They identify the missing records required to establish a fuller timeline and determine whether the operational containment, asset recovery and customer restitution processes have progressed as described. A related issue of how legacy deposit addresses can remain exposed after access controls change was explored in BlockBriefing’s earlier CoinDCX wallet investigation. The events involve different exchanges and there is no established shared cause.
Methodology: This report compares Mercado Bitcoin’s published customer notices with original incident-response information from Chainalysis and Bitquery’s documented on-chain investigation, including its November 3 corrections. BlockBriefing has not independently replicated all wallet-level transfer counts or obtained Mercado Bitcoin’s internal incident logs. Source attributions, estimated dollar values and unresolved technical causes are labeled accordingly. The figures may change as investigations and asset freezes continue.
