1. What happened
On November 2, Mercado Bitcoin disclosed an incident and temporarily suspended deposits and withdrawals. Chainalysis, which participated in the response, reports approximately $49 million stolen across seventeen blockchains and almost $10 million frozen. These are estimates within its observation scope: other researchers publish different measurements, which must not be combined into an artificial total.
2. What is verified
Bitquery reconstructs transactions from 35,853 Ethereum deposit addresses, including movements after the containment statement; its analysis does not establish which component authorized those signatures. The absence of customer harm and data leakage remains a company statement reported by local media. The actor, initial access vector, and motive remain unknown.
3. Why it matters for cyber geopolitics
The coordination described by Chainalysis among investigators, authorities, and issuers documents an international response. Decentralization nevertheless requires analysis at different levels: distributed consensus, key custody, and the ability to freeze tokens confer different powers. Multiple blockchains may depend on the same signing authority, without establishing a compromise of Bitcoin consensus or a global systemic impact.
4. Which dependencies can transmit the impact
An address assigned to a customer may have keys managed by the intermediary: its label does not identify who can move its funds. If that capability remained usable, closing the interface would not prevent further signatures. For some tokens, the issuer can also intervene, while freezing, actual availability, and restitution remain distinct steps.
5. Conditional consequences and signals to watch
Persistent compromised signing power would make it risky to resume automated transfers to old addresses; if a private key had been copied, closing service access would not render it unusable on the network. An incident confined to one component, with access removed and separate controls verified, would instead narrow the exposure. The technical report must clarify the mechanism; validated deposit instructions and transaction reconciliation would change the assessment.
6. What to prepare now
The custody lead, working with the incident manager, should map addresses, signing services, and privileges, documenting the conditions and limits of resumption. A treasury team using the custodian should verify updated instructions through an independent channel before resuming automated transfers, obtaining a traceable approval even for addresses already stored.
Sources and evidence
- Chainalysis — Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds
- Arkham — Mercado Bitcoin Hack: Trace the $46M Stolen On-Chain
- Bitquery — $48.5M left Mercado Bitcoin's wallets on 10 blockchains
- Portal do Bitcoin / UOL — Mercado Bitcoin Suffers Hack but Says Customer Funds Are Safe
- Exame / Future of Money — Mercado Bitcoin sofre ataque hacker estimado em R$ 217,7 milhões
Arkham and Bitquery publish original analyses of the same public ledgers using distinct methods and scopes; these are not independent ledgers. Chainalysis participated in the response. Local reports share the company as the origin of its assurances.