coindesk.com
Hackers continued stealing funds from Brazilian crypto exchange Mercado Bitcoin for roughly four hours after the company said it had contained the cyberattack, according to blockchain data.
The attacker drained 36,042 customer deposit addresses on Ethereum between 12:27 and 16:56 UTC on Nov. 2, despite the exchange saying that day at 12:56 UTC that the breach had been contained, according to blockchain data platform Bitquery.
The findings cast doubt on how fast Mercado Bitcoin brought the attack under control and suggest the hacker gained access to systems used to manage customer deposits.
Mercado Bitcoin wasn't immediately available for comment.
Bitquery traced $48.6 million in stolen assets across 10 blockchains, above the $40 million first reported. The exchange pledged to cover all user losses from the hack, and partners including Tether, Circle and Chainalysis helped freeze over $15 million.
The investigation also found links to a separate attack involving wallets believed to belong to crypto exchange BitMart.
The same attacker-controlled address started receiving funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin breach. Bitquery attributed roughly $391,000 in losses to those wallets, though BitMart has not confirmed that figure. Founder Sheldon Xia said that BitMart was hacked on Nov. 2 and that its preliminary investigation points to the group behind the Mercado Bitcoin attack.
The overlap raises the possibility that the attacker gained access to infrastructure used by multiple exchanges, though the cause of the breaches remains unknown.
Mercado Bitcoin suspended deposits and withdrawals following the attack and is set to reopen its website in view-only mode on Nov. 9, with no date yet for deposits or withdrawals.
