Mercado Bitcoin said to have stopped the hacking; the thefts continued, according to Bitquery

Mercado Bitcoin claims to have contained the hacking that targeted its platform on November 2. However, Bitquery’s analysis reveals that thousands of deposit addresses lost their funds after this announcement. Researchers tracked 48.6 million dollars worth of assets across eleven blockchains. This timeline questions the actual moment of containment and the extent of the access obtained by the attacker, especially concerning bitcoin-related funds. It highlights the limits of the initial public information.

Bitquery traces transfers after the announcement

The platform announced on November 2 at 9:56 AM that it had contained the incident. However, Bitquery identifies movements after this communication. 36,042 Ethereum deposit addresses were emptied between 9:27 AM and 1:56 PM. Transfers continued nearly four hours after the announcement.

These addresses contained about $266,000, a small part of the estimated amount. The emptying of these addresses remains important to understand the timeline. The data shows that the hacker could move funds after the Mercado Bitcoin announcement. They concern customer deposits, not just a central wallet.

A deposit address receives cryptocurrencies from a customer. The platform pools the assets into a shared hot wallet for daily operations. Each transfer requires a private key. Here, withdrawals seem to have been directly authorized by the concerned addresses, according to the Bitquery analysis.

Bitcoin private keys at the heart of questions

This method suggests that the attacker had the private keys or a system capable of signing on behalf of clients. Researchers raise two lines of inquiry: obtaining a key for each address or exploiting an authentication flaw. The analysis does not decide. It highlights a risk related to the deposit architecture.

Platforms generate deposit keys from a single master key. If this key or its associated system was compromised, access could go beyond the emptied addresses. Bitquery warns that other deposits might remain exposed. This hypothesis also concerns bitcoin-related addresses, even if the movements described are on Ethereum.

Researchers recommend not reusing old addresses before official security confirmation. This instruction aims to avoid new transfers to vulnerable addresses. For bitcoin holders, caution involves verifying platform information before any operation.

The amount of the theft and service resumption remain to be clarified

The financial assessment varies according to communications. Initial estimates mentioned more than 40 million dollars stolen. The updated Mercado Bitcoin FAQ reduces the amount to about 36.3 million. Bitquery estimates the stolen assets at 48.6 million dollars across eleven blockchains.

The gap between these estimates exceeds twelve million dollars, with no public explanation. Mercado Bitcoin does not detail why transfers continued after the declared containment. The company has, however, assured it will reimburse users’ losses with its own funds. This promise concerns its customers’ losses.

The platform plans a restart as of November 9. Customers will first be able to check their balances. Deposits, withdrawals, and transactions will remain unavailable at this stage. This limited opening will precede the restoration of services as users await clarification about their holdings.

The next steps will depend on the verifications and reopening announced by Mercado Bitcoin. The platform will have to specify if old addresses are safe. Until then, customers must follow its instructions and avoid any deposit to an unconfirmed address. The final assessment remains to be made.