$48.6 Million Stolen Asset Estimate Exceeds Exchange's Figure, Funds Still Moving After Mercado Bitcoin Attack

Odaily Report: After Brazilian crypto exchange Mercado Bitcoin announced it had contained a security incident, attackers continued to move funds for nearly four hours. According to Bitquery, between 9:27 AM and 1:56 PM Brazil time on November 2, 36,042 Ethereum customer deposit addresses were drained; the exchange announced at 9:56 AM that day that the incident had been brought under control.

Bitquery estimated the stolen assets across 11 blockchains at $48.6 million, higher than Mercado Bitcoin's latest estimate of $36.3 million. Transfers from the relevant Ethereum deposit addresses were directly authorized by the addresses, which Bitquery said suggests the attackers may have possessed the relevant private keys or been able to use a system that signs on behalf of users.

Mercado Bitcoin has said it will cover user losses with its own funds and advised customers not to reuse old deposit addresses until the exchange confirms it is safe. The exchange plans to restore account balance viewing on November 9, while deposits, withdrawals, and trading remain suspended, with no timeline yet for resumption. (Decrypt)