Mercado Bitcoin hack $8M larger than first reported

Funds Kept Leaving After the “All Clear”

Mercado Bitcoin announced at 12:56 UTC on November 2 that it had contained the attack. On-chain records show the theft ran until 16:46 UTC, roughly four hours after the exchange said it had stopped the attack. According to a CoinDesk report, the attackers began at 12:27 UTC and hit 36,042 customer deposit addresses on Ethereum.

Blockchain data platform Bitquery traced the $48.6 million across ten blockchains. Investigators also found links to another attack involving wallets tied to the BitMart exchange.

Mercado Bitcoin has pledged to cover all user losses. Tether, Circle, and Chainalysis are helping freeze more than $15 million of the stolen funds. PYMNTS has asked the exchange about the extended timeline but has not received a reply.

A Rough Stretch for Exchanges and Regulators

The breach lands in a month of heavy crypto crime headlines. Last week, the $6 billion Binance hack was described as the largest financial theft in history.

Regulators are weighing how to handle decentralized finance at the same time. Circle recently urged the Securities and Exchange Commission (SEC) to preserve technology neutrality and to clarify how its proposed Regulation Crypto Assets framework will treat permissionless networks. The underlying question is how authorities should oversee financial activity on infrastructure built to run without centralized gatekeepers, while investigators struggle to track illicit funds moving through it.

Fraud pressure is rising beyond crypto too. A PYMNTS Intelligence study, “Payment Protection: Why Firms Still Aren’t Real-Time Ready,” found that 57% of companies in payment-heavy industries reported facing more fraud in August.

Hashlytics Take

The number matters less than the clock. An exchange that declares an attack contained while thousands of deposit addresses are still being swept has not understood what the attacker actually controls. Hitting 36,042 individual deposit addresses points to access to the systems that manage customer deposits, not a single drained wallet that could be isolated with one decision. Until Mercado Bitcoin explains what “contained” meant at 12:56 UTC and what was still exposed afterward, its first loss figure and its first all-clear both deserve the same skepticism. The pledge to cover users is the right move, but it answers who pays, not how the attackers stayed inside for four more hours.