SKN | Mercado Bitcoin Hack Continued After Containment Claim, Raising Questions Over Exchange Security

Key Points:

• Blockchain analytics firm Bitquery identified approximately $391,000 in additional cryptocurrency theft hours after Mercado Bitcoin said its security incident had been contained.
• The same attacker reportedly targeted wallets that Bitquery linked primarily to BitMart, whose founder confirmed a November 2 security incident and suspected a connection.
• The developments highlight the difficulty of containing blockchain-related attacks and the importance of monitoring transactions beyond an exchange’s initial incident response.

A cybersecurity incident involving Brazilian cryptocurrency exchange Mercado Bitcoin has raised fresh concerns about the ability of centralized platforms to contain attacks and verify that unauthorized activity has stopped. A blockchain analytics investigation found that the attacker continued moving funds hours after the exchange publicly said the incident was under control, with subsequent transactions reportedly involving wallets associated with another major trading platform, BitMart.

Blockchain Analysis Identifies Continued Unauthorized Activity

According to findings attributed to Bitquery, the attacker behind the Mercado Bitcoin incident continued conducting transactions after the exchange announced that the attack had been contained. The subsequent activity resulted in approximately $391,000 in additional stolen funds, with most of the affected assets reportedly originating from wallets that Bitquery linked to BitMart.

The timeline is particularly significant. An exchange’s declaration that an attack has been contained generally indicates that its immediate response measures have been implemented. However, continued suspicious transactions can suggest that compromised credentials, previously authorized access or other vulnerabilities may remain exploitable outside the systems initially secured.

Blockchain transaction records can help investigators follow the movement of stolen assets across addresses and networks. Nevertheless, identifying wallet activity does not automatically establish the identity of the person controlling an address or prove that every associated transaction was part of the same attack. Attribution therefore remains an important distinction when assessing the scope of a security incident.

BitMart Confirms a Separate November 2 Security Incident

The reported connection has drawn attention to BitMart after its founder confirmed that the exchange experienced a security incident on November 2. The founder also expressed suspicion that the incident could be connected to the Mercado Bitcoin attack.

The potential overlap is important because cryptocurrency exchanges operate within an interconnected ecosystem of wallets, custodians, liquidity providers and blockchain networks. A compromise involving one platform can create exposure for other services if shared infrastructure, compromised credentials or connected operational arrangements are involved.

However, the reported wallet connections and the founder’s suspicions should not be treated as definitive proof that both incidents originated from the same breach or involved identical attack methods. Further technical investigation would be required to establish the relationship, identify the initial point of compromise and determine whether the attacker exploited a common vulnerability.

Containment Claims Face Greater Scrutiny

The Mercado Bitcoin timeline illustrates a wider challenge for centralized exchanges: the difference between stopping an immediate attack and confirming that all related unauthorized access has been eliminated. Even after an exchange isolates affected systems, attackers may retain access through previously compromised credentials, connected wallets or infrastructure that was not included in the initial response.

For institutional clients, this distinction has direct operational significance. Security assessments increasingly need to examine incident detection, withdrawal controls, wallet authorization, third-party dependencies and the ability to trace suspicious transfers after an initial breach. Public statements about containment are important, but independent forensic findings and transparent incident reporting provide additional grounds for evaluating an exchange’s response.

Cross-Exchange Risk Remains a Key Market Concern

The reported $391,000 in additional losses may be smaller than some of the largest cryptocurrency exchange breaches, but the incident’s significance extends beyond the amount involved. The possibility that the same attacker targeted wallets associated with multiple platforms demonstrates how security events can spread across the broader digital-asset ecosystem.

Investors and industry participants will be watching for further disclosures from Mercado Bitcoin and BitMart, particularly regarding the source of the vulnerabilities, the final scope of losses and whether customer assets were affected. Until investigators establish the relationship between the incidents, the connection remains a reported lead rather than a confirmed conclusion. For centralized exchanges, the episode reinforces a critical operational requirement: containment must be demonstrated through sustained monitoring and verified security controls, not simply announced.

Source: CoinDesk – Mercado Bitcoin hack continued hours after exchange said attack was contained, report finds