The hack at Mercado Bitcoin kept running for hours after the exchange told the public the attack had been brought under control, according to a report on the incident. The same attacker is said to have drained about $391,000, mostly from wallets that blockchain analytics firm Bitquery ties to BitMart. BitMart's founder confirmed a November 2 hack at that exchange and suspects it's connected to the Mercado Bitcoin breach.
The containment claim and the clock
The detail that matters most here is timing. An exchange saying an attack is contained is a signal to users — often the signal that determines whether they leave funds in place or start moving them. If the report holds up, that signal went out while the attacker was still working. Mercado Bitcoin hasn't publicly addressed the gap between the containment statement and the continued losses.
That's a serious problem for a Brazilian exchange with a large retail base. Users can't audit an incident in real time. They rely on the exchange's own account of what's happening, and when that account is premature, the damage isn't just the stolen funds. It's the trust hit that follows.
BitMart's founder points at a shared attacker
BitMart's founder confirmed the November 2 hack and said he suspects a link to the Mercado Bitcoin incident. The evidence cited is on-chain: Bitquery attributes most of the $391,000 in stolen funds to wallets connected to BitMart. That's not a court finding, and it doesn't prove the two breaches were run by the same people. It does mean one attacker, or one cluster of wallets, touched both.
Two exchanges hit within days of each other is the kind of pattern that gets security teams on a call fast. It's also the kind that's hard to attribute cleanly. Wallet links get reused, and attackers sometimes route funds through infrastructure others have touched before.
What the $391,000 figure tells us
Roughly $391,000 isn't a huge number by exchange-hack standards. That's part of why it's interesting. Smaller, targeted drains can be harder to spot than a headline-grabbing breach, and they can run longer before anyone raises an alarm. The report's focus on BitMart-linked wallets suggests the losses landed in specific places rather than being spread across the exchange's whole treasury.
Neither exchange has published a full breakdown of affected addresses. Bitquery's attribution is the main thread connecting the two incidents so far.
The open question
The unresolved piece is the containment timeline. When exactly did Mercado Bitcoin declare the attack contained, and when did the last unauthorized transfer go through? That gap is the difference between an exchange that got hit and an exchange that got hit and misread the situation while users were still exposed.
BitMart's founder has acknowledged the November 2 breach and raised the possibility of a shared attacker. Neither exchange has said whether law enforcement has been brought in, and no regulator has commented publicly. The next concrete marker will be whether Mercado Bitcoin addresses the report's claim directly — and whether Bitquery's wallet attribution gets corroborated by a second source.
