Mercado Bitcoin Said Its Hack Was Contained, But Blockchain Data Tells a Different Story

Fresh forensic analysis traces $48.6 million across 11 blockchains and finds thousands of customer deposit addresses drained hours after the Brazilian exchange said it had stopped the breach on Monday.

The top 3

  1. Discrepancy Between Containment Claims and On-Chain Activity: Mercado Bitcoin officially announced the containment of the security breach at 9:56 a.m. (Brazil time) on November 2. However, forensic analysis by Bitquery shows that 36,042 Ethereum deposit addresses were emptied between 9:27 a.m. and 1:56 p.m., proving that unauthorized fund transfers persisted well after the exchange's public declaration.
  2. Mechanism of the Unauthorized Asset Drain: The attacker successfully moved funds by authorizing transactions directly from customer deposit addresses. This implies the compromise of either the individual private keys for those addresses or, more likely, a systemic compromise of the exchange's signing architecture—such as a master key or a signing service—capable of generating valid transaction signatures for a massive number of accounts.

Sources

Open the full topic