Mercado Bitcoin Says $38 Million Left. The Chain Says $48.5 Million — and the Key Still Signs for Customer Deposits

Mercado Bitcoin stopped deposits and withdrawals on Monday 2 November after wallets on at least ten blockchains paid out to an address the exchange does not control. On Tuesday the Brazilian exchange put a number on it: about $38 million lost, $11 million already frozen with help from Tether, Circle and Chainalysis, no customer money at risk and no data leaked.

The chain tells a bigger story. Bitquery, which read all ten blockchains transfer by transfer, counts $48.5 million at the value of each transfer, 35,853 customer deposit addresses emptied on Ethereum, and 106.07 BTC still sitting untouched at the attacker's Bitcoin address. Arkham's trace landed at $46 million. Hypernative's first alert said more than $40 million. Four numbers for one night, and $10.5 million between the smallest and the largest.

That gap is not a rounding error. It is the difference between what an exchange books as its loss and what a chain records as its outflow, and it is the number that decides how much of this week's damage Mercado Bitcoin's own balance sheet absorbs.

One test transaction, then twenty-five minutes

Arkham's timeline opens on Base at 01:22 UTC with a 0.0001 ETH payment out of a Mercado Bitcoin hot wallet — the smallest transfer that proves a key works. The main leg came at 06:24 UTC, when 2,852 ETH worth $6.52 million left an Ethereum hot wallet. Within two minutes the same address had taken $2.99 million of USDT and $2.24 million of USDC. At 06:41 UTC, 104.43 BTC worth $8.16 million was swept from the exchange's Bitcoin hot wallet.

The rest arrived in pieces: SOL, TRX, stablecoins on Tron and Solana, and dozens of ERC-20 tokens down to PEPE, ONDO, PENDLE, VIRTUAL and UNI. Bitquery counts 188 transfers worth $29.5 million out of the Ethereum hot wallet alone in 24 minutes — 61% of the entire loss on a single chain — and 25 minutes for all ten chains to pay out. One address was used per chain, and the same address on every chain that runs like Ethereum; two of them were funded the evening before the attack.

Arkham has logged 287 swaps out of the attacker's wallets since, dumping RENDER, WIF, KMNO and POPCAT. Most of the money has not moved far: $19.5 million went into ten new Ethereum wallets, some Solana balances were swapped into ETH through Mayan, and no deposit into a centralised exchange has been spotted.

Then the deposit addresses started signing

This is the part that outranks the dollar figure. A customer deposit address already holds coins that the exchange has credited to a user. From 12:10 UTC on Monday — more than five hours after the hot wallets were emptied — those addresses began sending their whole balances to the same attacker, each one signing its own transfer.

By 15:44 UTC, 35,853 deposit addresses on Ethereum had done exactly that, worth $261,000 in total. The exchange published its containment statement at 12:56 UTC, in the middle of the sweep, and the sweep continued for more than two hours afterwards; the attacker even used deposit addresses that still held ETH to pay network fees for the others, so the tokens could be taken too.

CertiK's Dickson Wu reached the same conclusion from a smaller sample in his first post-mortem: the attackers picked at eight small chains for four hours, then moved on the main hot wallets, pushing tiny amounts of Ether out of 27,160 addresses. Whoever holds that signing path can also move money out of Mercado Bitcoin's customer deposit addresses — which is why an address printed before Monday is not an address to send to now.

What was frozen, and what was not

Bitquery's split is the most detailed one published. Tether froze $5.9 million across USDT, USDT0, USAT and its gold token on Polygon, Tron, Ethereum and Solana; Paxos froze $1.5 million of PAXG and USDP. That is $7.3 million frozen against $48.5 million taken. Tether's chief executive Paolo Ardoino publicly confirmed $4.5 million of USDT in the first tranche, hours before the larger figure was visible. Circle had frozen nothing at the last check, leaving $4.29 million of USDC and EURC free to move.

Mercado Bitcoin's own $11 million is higher than either public freeze total, which means there are either more freezes not yet announced or a different cut-off time behind the exchange's arithmetic. Both are worth watching, because a freeze is the only part of a hack that gets reversed.

Four days after the largest theft on record

The context is not quiet. Binance lost roughly $6.3 billion on 29 October, the biggest crypto theft ever recorded, and the FBI attributed it to North Korea's TraderTraitor group two days later. Binance reopened withdrawals on Sunday and customers pulled a net $4.72 billion out afterwards, as its emergency bitcoin reserves fell to roughly half their pre-hack level to cover the hole — a sequence already traced post by post on this site when the exchange restarted withdrawals and $4.65 billion walked out in nine and a half hours.

No public evidence ties the two incidents together, and Mercado Bitcoin has not said which of its systems was compromised. What the two share is the shape: hot wallets with live signing authority, one address per chain, and hours of quiet between the first test payment and the biggest transfer.

What the tape does with it

Bitcoin is not pricing a second exchange failure. It opened Tuesday at $76,816.01, dipped to $76,388.88 in the European morning and last traded $77,528.55, up 0.93% on the session and $820 above its 100-day moving average at $76,708.63 — the line the whole of last week's selloff has been leaning on. The 30 October low of $76,325.98 is the shelf below, and the 50-week at $75,588.81 sits 737 points under that. Above, $78,878.01 is the ceiling of the last three sessions, and the 50-day at $81,968.04 is where October broke.

Ether is at $2,289.45, still 15 points under its 50-week at $2,304.83 after a recovery from the $2,174.08 flush of 30 October. Neither chart carries an exchange-risk premium yet. That is the interesting part: the market has treated a $6.3 billion theft and a $48.5 million one as operational news rather than a solvency event, and it will keep doing so until someone fails to pay.

What decides the next headline

Three things, in order of consequence. First, whether Mercado Bitcoin rotates deposit addresses and says so publicly, because until it does the old ones remain a live signing path. Second, whether the freeze total climbs toward the exchange's $11 million or stalls at the $7.3 million that Bitquery can see. Third, whether the 106.07 BTC at the attacker's Bitcoin address moves — every previous attribution in this cycle started with a conversion, not a withdrawal.

The exchange has promised to absorb the loss and says customers will not pay for it, which makes this a balance-sheet story rather than a user story for anyone holding a balance there. It is a different story for anyone who sent coins to an address generated last month. The full set of venues, faucets and on-chain tools we track lives in the EarnCrypto tools directory, sorted by what actually pays out.