Mercado Bitcoin - Rekt

Six days before the hack, Mercado Bitcoin applied to Brazil's central bank for authorization to operate as a regulated crypto brokerage, custody included.

Its CEO said the exchange had invested early in security.

On November 2, an attacker drained its hot wallets on 11 chains, then went to work on the customer deposit addresses.

At 12:56 UTC, Brazil's largest crypto exchange announced it had identified and quickly contained the incident, with no harm to customers.

The Ethereum deposit sweep was already half an hour old, and it ran for four more.

By 16:56 UTC, 36,042 Ethereum deposit addresses had each signed their balances over to the attacker, and Bitquery counts $48.6 million gone across 11 blockchains.

Bitquery also traces funds from wallets tied to BitMart into the same attacker address, starting 53 minutes before the Mercado Bitcoin drain.

If the incident was contained, who was still signing?

Tether moved before Mercado Bitcoin said a word.

At 10:21 UTC on November 2, the stablecoin issuer froze the attacker's USDT0 on Polygon, then its USDT on Tron and Ethereum about an hour later.

Mercado Bitcoin's first public statement was still more than two and a half hours away.

The theft itself was older than that. Between 06:24 and 06:48 UTC, the exchange's hot wallets on ten chains paid the same attacker.

On Ethereum, 188 transfers moved $29.5 million in 24 minutes. The hot wallet sent 2,852 ETH first, then USDT and USDC, then token after token, down to scraps worth a few dollars.

Hypernative flagged more than $40 million in suspicious transfers across at least ten chains.

In an alert shared by Opsek founder Pablo Sabbatella, it described plain transfers, not a smart contract exploit, and said it was how the attacker obtained signing access is not yet known.

No elaborate onchain exploit was visible. Just an exchange's own wallets, paying out.

On Ethereum, the stolen funds then sat untouched for roughly five hours.

Just after midday UTC, 2,800 ETH moved to a fresh wallet. At 12:27, Mercado Bitcoin's customer deposit addresses began sending their balances to the attacker, one address at a time.

Twenty-nine minutes later, the exchange spoke.

"We identified and swiftly contained a security incident in one of our systems early this morning," Mercado Bitcoin posted at 12:56 UTC, adding that there had been no harm to customers and no data breach. Deposits and withdrawals were suspended as a precaution.

At 14:24 UTC, the exchange published five attacker destination addresses on Twitter, covering EVM chains, Bitcoin, Solana, Stellar and Tron, "exclusively for identification and tracking purposes."

The tracking was already underway. "Tether froze more than 4.5M USDT related to this security incident," Paolo Ardoino posted.

Arkham analyst Emmett Gallic put the tally at “$46M stolen and growing.”

In a later post, he wrote: “The Mercado Bitcoin Hacker is still sweeping thousands old deposit addresses.” “Not leaving a dollar behind.”

At 16:56 UTC, the Ethereum deposit sweep finally stopped. Bitquery counted 36,042 addresses, roughly four hours after Mercado’s "swiftly contained" announcement.

By evening, Mercado Bitcoin's language had shifted.

The reassurance shifted from what had happened to what customers could expect: “No harm to customers” was followed by a promise that they “will not suffer any loss of assets.” The first asserted no customer harm; the second promised no customer loss.

On Twitter, the exchange put the assets involved at approximately $38 million, with $11 million blocked alongside Tether, Circle, Paxos, BRL1 and Chainalysis.

That same evening in Brazíl, Times Brasil reported the company's figure as roughly $49 million involved, with $11.2 million blocked.

Chainalysis's initial account also estimated about $49 million, describing attacker activity across 17 chains.

Two numbers, one exchange, one night. That gap would come back.

Hot wallets are built to send money. But emptying thousands of deposit addresses required something broader: their keys, or access to whatever signed for them.

So who was telling 36,042 of them to pay a stranger?

Two Kinds of Yes

Bitquery lays out the custody model: Customers receive their own deposit addresses, deposits are credited to their accounts, and the coins are later swept into hot wallets that pay out withdrawals.

The customer never holds those keys. The exchange does.

That gives an exchange two different things to protect: The system that decides what its hot wallets pay, and the key material behind every deposit address it has ever issued.

On November 2, the attacker could obtain payments from both kinds of wallets.

Bitquery spotted the seam. The large Bitcoin payment from Mercado Bitcoin's hot wallet looked like one of the exchange's ordinary payouts.

The Bitcoin deposit sweeps did not: Different software, and far higher fees.

One pattern looks like the exchange's own machinery doing the attacker's work. The other looks like someone outside that machinery, signing on their own.

Bitquery says the pattern fits access to the exchange's payout system plus access to the deposit keys, while cautioning that the chain alone cannot prove it.

The deposit sweep shows what that breadth of signing access was worth.

Each of the 36,042 Ethereum addresses signed its own transfer of its full balance. Late in the run, the attacker used deposit addresses still holding ETH to pay network fees for others, so their tokens could be emptied too.

It was patient work for small money. Bitquery found that about 91% of the swept addresses held less than $10. The 113 holding $100 or more accounted for 61% of the $266,000 total.

The Ethereum hot wallet had given up $29.5 million in 24 minutes. The deposit addresses yielded less than 1% of that over four and a half hours.

The sweep didn't stop at Ethereum. Fifty-three Bitcoin deposit addresses were emptied. On BNB Chain, 143 addresses paid the attacker from 14:26 UTC, and a busy wallet Bitquery's labels tie to the exchange, one that had previously collected from 1,483 deposit addresses, sent $124,000 by 18:08 UTC.

On Base, 308 more deposit addresses paid a new attacker wallet in three minutes that evening, nearly five hours after "swiftly contained."

Access to the underlying keys could explain how the attacker drained so many addresses. Bitquery notes that exchanges commonly derive deposit keys from a master key. If the attacker obtained that root, the exposure could extend to other addresses derived from it, not just the ones already drained.

That is also why the timeline matters. Disabling a payout system can stop requests that run through it. It does nothing to a private key someone else already holds.

The groundwork was laid the night before. The attacker's Ethereum address received its first coins on the evening of November 1, and its Tron address minutes later. Two small wallets that tested the Ethereum address also paid the Tron one, suggesting a single operator set up both.

What the chain cannot show is the way in.

The transactions establish valid signatures across hot wallets and thousands of deposit addresses. They don't say whether keys were extracted, a signing service was abused, a wallet-management system was hijacked, or an insider or vendor opened the door.

Mercado Bitcoin has described the incident as occurring in "one of our systems." In its public statements reviewed through November 9, Mercado Bitcoin did not identify the compromised system, explain how the attacker gained access, or say whether affected deposit addresses would be replaced.

Bitget said its private keys were not compromised. Binance said it found no evidence of a private-key leak. In those same statements, Mercado Bitcoin offered no comparable assurance about its keys.

Bitquery advises users not to send coins to an old Mercado Bitcoin deposit address until the exchange says it is safe, and to expect new deposit addresses.

With signing power that reached from hot wallets to pocket-change deposit addresses, where did the attacker take $48.6 million next?

Clearance Sale

The $48.6 million headline is a valuation, not a cash balance.

Bitquery values each token at its price when it left the exchange and leaves out tokens with no market price at all.

One holding makes the valuation problem especially clear: EVA on Arbitrum counts for $1.21 million at its quoted price, but trades less than that in a typical week. Strip it out and the figure falls to $47.4 million. That quoted value does not mean the attacker could find enough buyers to sell the entire holding at that price.

Ethereum carried 61% of the loss, at $29.72 million. Bitcoin followed at $8.30 million, then Solana at $3.22 million, Stellar at $2.12 million, Arbitrum at $1.53 million and Tron at $1.51 million. Polygon, Avalanche, BNB Chain, XDC and Base made up the rest.

The Ethereum drain began with a single payment at 06:24:47 UTC in block 26325283: 2,852.07 ETH, a plain transfer with no contract call attached.

Mercado Bitcoin Ethereum Hot Wallet: 0x5cc7787778b4d20a947dcc53b41f593cfd27d548

Attacker's Main Address on the affected EVM chains: 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478

2,852 ETH Transfer: 0xf447ad5114dd01d78847799bf82b34f9b2ac04b97bbc5a81370eb753fa81ff68

The stablecoins went next. Arkham’s trace puts $2.99 million of USDT and $2.24 million of USDC within about two minutes of the ETH.

USDT Transfer ($2.99M, per Arkham): 0x041caa2acecd6c7629d4406b18b4c794846ca9d244db14a9b8886cd477b7db75

USDC Transfer ($2.24M, per Arkham): 0x5caca820a2aaafb3e3dfaa8679d4dd2cdc8b3255797afa15ddceaeb15951a3b3

At 06:41 UTC, 104.43 BTC moved from Mercado Bitcoin to the attacker in a single payment. Bitquery says the transaction looked like the exchange’s normal payouts.

Bitcoin Sweep (104.43 BTC): ada3bb2304be5de8dd7e67bf9be8c765c5f020a34508bd248f345a1205c5fcf9

Attacker's Bitcoin Address: 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp

What happened next depended partly on the asset. Some issuers could freeze or recover their tokens; coins such as bitcoin and ether had no equivalent issuer-controlled freeze mechanism.

The spendable portion of the freezable tokens shrank fast. Bitquery counts $11.8 million locked by five issuers, about 24% of the gross haul.

Mercado Bitcoin separately reported more than $15 million blocked by November 4, a higher figure than Bitquery's $11.8 million count.

Tether led, with $5.9 million frozen across four chains. On Solana, the attacker spent the hour before Tether's 14:55 UTC freeze selling tokens into USDT. Its last sale landed one second before the freeze.

Attacker's Solana Address: 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J

Attacker's Tron Address: TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L

Circle locked $4.3 million in USDC and EURC, beginning at 16:19 UTC, about six hours after Tether's first freeze. Circle initially blocked EURC transfers at a new Ethereum wallet that held none of the token. About $400,000 of EURC at the attacker's main address stayed free until 00:55 UTC on November 4.

Wallet Holding 2.24M USDC, Frozen by Circle: 0x3ce76d2d27cc80e44c7d9532423633c7f940c779

Paxos froze PAXG and USDP, including 369 PAXG that had already been moved to a new wallet.

Wallet Holding PAXG, Frozen by Paxos: 0x3c6daf929ff36e50ceb66807ebe8abe83653e051

Agora froze $106,000 of AUSD, Ripple $39,000 of RLUSD. Synthetix went a step further, using its control over SNX to pull about $76,000 back out of the attacker's address. MetaMask USD blocked 34 attacker wallets the next evening, by which point they held almost none of it.

The attacker’s Stellar account held 6.71 million XLM, which Circle could not freeze, alongside USDC and EURC that Circle had frozen.

Attacker's Stellar Address: GDXYRI6IONQA5YTGRLQ6O3FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP

The rest moved on its own schedule.

By the afternoon of November 2, $19.5 million on Ethereum had been spread across ten new wallets. Overnight, 3,649 ETH, about $8.2 million, was regrouped into two fresh ones.

Fresh Wallet (2,979 ETH regrouped overnight): 0x59a919e8d0582ce62c8de9431b3ebc6fa121731e

Fresh Wallet (670 ETH regrouped overnight): 0x071f8366375fdd21423bb23ae19e4b91f03f9270

Wallet Receiving the Attacker’s First Post-Drain ETH Transfer (2,800 ETH, 12:07 UTC):
0x8419e7824e785c4ac8d9d94a0093c437ab1ff320

2800 ETH Transfer:
0x49713cbd0582544cecbe1229336cee0d85be4dd57750df80d95881300d73dac7

Other chains fed back into Ethereum. The attacker sold SOL and USDT through Mayan for about $1.15 million of ETH. Relay, another such service, turned down two of its orders.

Bridgers took 1.71 million TRX, worth about $549,000, and paid out on one order within eight minutes. A second, worth $137,000, was still unpaid at Bitquery's read, more than a day later.

The AVAX took the scenic route: A small test through MetaMask's bridge, then 76,000 AVAX moved to a new Avalanche address 90 seconds later.

Attacker's Avalanche Address (76,000 AVAX): 0x71ddbdd9b865d74b3c21068d71b3a11e110db728

76,000 AVAX Transfer:
0x1df5714bf287ff1e6a38582d82fb49764a72676f168d4a7f369c240ab2d572bc

Polygon was the attacker's own problem. At Bitquery's snapshot, the address had no POL for network fees, leaving its unfrozen tokens there temporarily stranded.

Then came the sale. From 13:31 UTC on November 3 to 10:01 UTC on November 4, the attacker sold 136 different tokens through MetaMask's swap service, 398 swaps worth about $11.9 million. PEPE, AAVE and UNI led the list.

The swaps returned 4,804 ETH, worth about $11.0 million, roughly $900,000 less than Bitquery's valuation of the tokens sold.

Before most sales, the tokens hopped to a fresh wallet and were sold from there. Of 33 wallets used this way, six ended up holding most of the ETH.

Fresh Wallet (1,275 ETH from token sales): 0x469189223f286b51198163b4eb5a1e532669523d

Fresh Wallet (1,205 ETH from token sales): 0xf666e184bb8d7b9724c1746e3621e72df4d3ce08

Fresh Wallet (1,178 ETH from token sales): 0xbdd1369a581541e034c6b9790178d51e1013dab3

Collection Wallet (ETH from Bridgers and token sales): 0x4d5f3758938df94a76bfd19652f118ccd7a72c9d

On November 4, the collection wallet sent ETH to:
0x3dE1e4045aD112D8B807CD28dc4B8894DE935c49

Transfer Transaction:
0xd6046d6465f37f0cd4f81bc69b029e4294b5a9667251d683d7eb7930eb0abf01

By Bitquery's last read, between 10:02 and 10:08 UTC on November 4, the attacker held 8,678 ETH, about $20.1 million, across ten Ethereum wallets.

The 106.07 BTC still hasn't moved as of November 10th:
19qGpsHvzh1t6pVi526XNNkh6hW6prDZp

The largest unsold position was about $1.4 million of PENDLE.

Roughly $100,000 had left those Ethereum wallets for other chains.

Bitquery had observed no deposits of the stolen funds into a crypto exchange within its tracing window.

Funds continued to move from the attacker’s main Ethereum address on November 9.

The inventory was still moving.

The money left a trail across 11 chains. The attacker's address left one too, and part of it started somewhere other than Mercado Bitcoin.

Why had the same address received funds from wallets tied to BitMart 53 minutes before the main event?

View Only

Mercado Bitcoin was not the attacker's first stop that night.

Bitquery traces about $298,000 into the same attacker address from wallets on Base, Arbitrum and Optimism, starting 53 minutes before the Mercado Bitcoin drain. Nearly all of it came from three wallets Bitquery ties to BitMart.

Bitquery's labels mark the Arbitrum wallet as a BitMart hot wallet.

BitMart-Labeled Arbitrum Hot Wallet: 0xb4af4d0b9bd38c9f2fec9778e48667912f778f01

The Base wallet is murkier. Arkham's write-up dates the start of the attack to a 0.0001 ETH test from what it calls Mercado Bitcoin's Base hot wallet at 01:22 UTC.

Bitquery, which says one outside label set calls the wallet Mercado Bitcoin's, doubts it: None of the wallet's past payers appear as Mercado Bitcoin deposit addresses in its data, and in 2024 the wallet traded small test payments with an address BitMart lists in its proof of reserves.

A quick check of Arkham confirms it labels the wallet as Mercado Bitcoin’s.

Base wallet labeled by Arkham as a Mercado Bitcoin hot wallet:
0xc3F6b6c4309Ba9A9887216DbeBf39FAC78406696

The attacker came back to Base that evening: At 20:20 UTC, 80 different tokens left that wallet in six minutes. Separately, between 20:19 and 20:44 UTC, about 1,400 Base deposit addresses each sent the attacker a few dollars in ETH.

On Arbitrum: 1,320 deposit addresses, three in four labeled BitMart’s by Bitquery, paid the wallet behind that Base sweep.

Five smaller chains added about $30,000, valued at November 3 prices.

BitMart's founder Sheldon, confirmed the breach without confirming the number. On November 3, Sheldon posted that BitMart had been hacked the day before, called the amount small, and said a preliminary investigation pointed to the group behind the Mercado Bitcoin attack.

Sheldon also described a security team left severely understaffed amid restructuring. He cited threats against employees and alleged retaliation by former staff, saying these had complicated efforts to retain technical personnel.

BitMart announced a wind-down in July, scheduling the end of trading for August 26. It lost $196 million in December 2021, a theft its CEO at the time attributed to a stolen private key.

If the wallets are BitMart's, Bitquery writes, the attacker held signing power at two exchanges on the same night.

A shared supplier, such as a firm running wallets for both, would be worth examining.

No shared vendor or common entry point has been established. In the statements reviewed for this story, neither exchange has said whether it uses one.

Mercado Bitcoin, meanwhile, was busy reassuring.

On November 3, the exchange told customers their assets were secured and their balances remained recorded in their accounts. It put the affected assets at $36.3 million, with $12.9 million blocked, and warned that it never asks for passwords, codes or transfers.

On November 9, the exchange announced the gradual return of website access to check balances and holdings, with displayed crypto balances reflecting customers’ pre-incident November 2 positions.

Trading, withdrawals, deposits, transfers, Pix and card services remained unavailable.

The next phase, scheduled for the following week, includes account revalidation and Pix withdrawals restricted to accounts in customers’ own names. Trading and crypto transfers would return in later phases.

The exchange had promised to replace affected customer assets with its own resources. By November 9, it said it was already replenishing those assets using its own funds.

One line of the exchange’s reassurance named a familiar partner.

Tether invested $20 million in Mercado Bitcoin in July to support its expansion into tokenized assets and other blockchain-based financial services

That investor also became the first issuer to freeze funds linked to the attack. Bitquery puts Tether’s frozen total at $5.9 million, more than any other issuer, and records its first freeze at 10:21 UTC, more than two hours before Mercado Bitcoin’s public statement.

By November 9, the exchange said it had frozen more than 33% of the diverted assets and was replenishing the affected assets with its own funds.

Frozen is not returned. Bitquery reports that Synthetix removed about $76,000 in SNX from the attacker’s address, but does not identify the recipient. The exchange’s updates do not clarify whether that removal is included in its reported figures.

The incident also followed a regulatory milestone. Mercado Bitcoin filed its application for authorization to provide virtual-asset intermediation and custody on October 27, ahead of the October 30 filing deadline.

Those reports do not establish the application’s outcome or include a central-bank response to the incident.

A practical question remains about deposit addresses. Bitquery advises customers not to send coins to old Mercado Bitcoin addresses until the exchange says they are safe.

The exchange’s November 9 update says crypto sent to valid MB addresses will be credited when transfers resume, but does not specify whether old addresses will be replaced.

The reopening begins with access to balances and holdings, not withdrawals. The exchange scheduled Pix withdrawals for the following week, after account revalidation and only to accounts in customers’ own names.

Crypto transfers would follow in a later phase, with no date given.

The numbers are due back on screen. When can customers withdraw?

On October 27, Mercado Bitcoin applied for authorization as a virtual-asset brokerage, custody included.

Six days later, an attacker was signing transfers out of its customers' deposit addresses.

The main hot-wallet drain took about 25 minutes; the Ethereum deposit sweep ran about four hours, past the exchange's claim that it had quickly contained the incident.

Bitquery puts the theft at $48.6 million across 11 chains, with $11.8 million frozen by issuers, and at its November 4 holdings snapshot, most of the rest still sat in wallets it attributes to the attacker.

The exchange says it is already replenishing affected assets with its own funds, but Monday's initial reopening offered balances, not withdrawals, with Pix withdrawals to customers' own accounts scheduled for the following week, after account revalidation, and crypto transfers left to later phases.

The exchange’s initial announcement described an incident in “one of our systems,” without identifying which one or saying whether the keys behind the affected deposit addresses had been replaced.

If Bitquery's BitMart attribution holds, the same attacker found signing power at two exchanges in a single night, and the investigation identifies neither a common supplier nor an entry point.

Custody is what Mercado Bitcoin applied for authorization to provide.

Can it prove the attacker's signing access is gone?

REKT는 익명 작성자들에 의한 공공 플랫폼이며, REKT에 작성된 관점이나 내용에 대해서 그 어떤 책임도 지지 않습니다.

기부 (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C

disclaimer:

REKT는 당사 웹 사이트의 익명의 작성자 또는 REKT에 의해 게시되거나 관련된 서비스에서 게시되는 콘텐츠에 대해 어떠한 책임도 지지 않습니다. 당사는 익명 작성자들의 행동 및 게시물에 대한 규칙을 제공하지만, 익명의 작성자가 웹 사이트 또는 서비스에 게시, 전송 혹은 공유한 내용을 통제하거나 책임지지 않으며, 귀하가 웹 사이트 또는 서비스에서 직면할 수 있는 불쾌함, 부적절함, 음란함, 불법 또는 기타 해로운 콘텐츠에 대해서도 책임을 지지 않습니다. REKT는 당사 웹 사이트 또는 서비스 사용자의 온라인 또는 오프라인 행위에 대한 책임을 지지 않습니다.