One Attacker, Two Exchanges, 25 Minutes: The $49 Million Multi-Chain Heist That Hit Mercado Bitcoin and BitMart in the Same Night

IT 6 Minutes

At 6:24 on the morning of Sunday, November 2, something unusual started happening on Ethereum. A wallet that had been dormant for less than 24 hours began emptying the Mercado Bitcoin hot wallet — 2,852 ETH first, then USDT and USDC, then 185 more individual token transfers. By 6:50 a.m. UTC, it was over. Twenty-six minutes. Ten blockchains. Approximately $48.6 million gone.

What most of the crypto industry did not know yet was that the same attacker had already been at work for more than an hour, quietly draining wallets on Arbitrum, Base, and Optimism that blockchain researchers would later link to BitMart — an exchange already deep in court-supervised restructuring proceedings. The two breaches, unfolding in the same few hours, have raised a question that the industry has been reluctant to confront directly: what happens when a single attacker holds keys to more than one exchange at once?

The Mercado Bitcoin Timeline: 25 Minutes, 10 Chains

Mercado Bitcoin, the largest cryptocurrency exchange in Latin America, was founded in São Paulo in 2008 and processes billions of reais in trading volume annually. On the morning of November 2, it became the target of one of the most sophisticated and fast-moving exchange hacks on record.

According to blockchain analytics firm Bitquery, the attacker drained Mercado Bitcoin’s hot wallets on ten separate blockchains between 6:24 and 6:50 a.m. UTC — a window of roughly 26 minutes. The chains hit were Ethereum ($29.7 million), Bitcoin ($8.3 million), Solana ($3.2 million), Stellar ($2.1 million), Arbitrum ($1.5 million), Tron ($1.5 million), Polygon ($1.2 million), Avalanche ($659,000), BNB Chain ($221,000), and XDC ($96,000). Chainalysis, working with Mercado Bitcoin directly, placed the total at approximately $49 million — close to Bitquery’s independently derived figure of $48.6 million.

The attacker did not stop at the hot wallets. Beginning around 12:27 p.m. UTC — more than six hours after the initial drain — the same attacker systematically swept 36,042 individual customer deposit addresses on Ethereum. Bitquery found that about 91 percent of those addresses held less than $10 each, suggesting the attacker had automated the sweep entirely. The collective take from the deposit addresses was approximately $266,000: relatively small, but the act of sweeping them suggested access to the exchange’s key derivation system, not just its hot wallet credentials.

Mercado Bitcoin said publicly that the attack was “contained quickly” at around 12:56 p.m. UTC. Bitquery’s on-chain data shows the deposit sweeps were still in progress at that moment and continued for roughly four hours afterward.

BitMart: Hit First, Announced Last

The BitMart connection emerged quietly. Blockchain researcher NeyLong flagged it on X, and Bitquery’s investigators confirmed the link through on-chain tracing: the same attacker that drained Mercado Bitcoin had been active on Base, Arbitrum, and Optimism starting approximately 53 minutes before the main Mercado Bitcoin drain began.

The amounts taken from the wallets linked to BitMart were comparatively modest — approximately $391,000 across the three chains. But the timing is what analysts find most striking. The attacker appears to have used BitMart’s wallets first, then pivoted to Mercado Bitcoin’s far larger reserves. Whether the BitMart access served as a proof-of-concept, or whether the attacker simply held keys to both exchanges and ran them sequentially, remains unclear.

BitMart founder Sheldon Xia confirmed the breach on November 3 in a post on X, writing: “Yes, we got hacked yesterday too.” He described the amount as “relatively small” and said the team had acted quickly. He added that his initial investigation suggests “the same group” was behind both the Mercado Bitcoin attack and the BitMart breach.

The admission came in difficult circumstances. BitMart announced a wind-down in July 2026 and halted trading in August. The exchange is currently in court-supervised restructuring with Alvarez & Marsal as its financial adviser. Xia acknowledged that the security team is “severely understaffed” after a round of departures, writing: “It took considerable effort and individual conversations to persuade some key technical staff to remain.”

The Stablecoin Freeze Response — and Its Limits

What happened in the hours after the Mercado Bitcoin drain illustrates both the growing power of stablecoin issuers as a first-response tool — and the significant limits of that power.

Tether moved first, freezing the attacker’s USDT positions on Polygon at approximately 10:21 a.m. UTC, then following up with freezes on Tron and Ethereum less than 90 minutes later. Circle froze USDC positions on Polygon and Ethereum at around 4:19 p.m. UTC — roughly six hours after Tether had acted, by which point the attacker had already begun moving funds. Paxos froze PAXG and USDP. Agora froze $106,000 in AUSD. Ripple froze $39,000 in RLUSD. Synthetix used a protocol mechanism to pull approximately $76,000 in SNX back out of the attacker’s address in the hours after midnight.

In total, Bitquery estimates that approximately 24 percent of the stolen funds — roughly $11.4 million — have been frozen across five issuers. The remaining $36.8 million is in assets no issuer can touch: primarily Bitcoin, ETH, and other non-freezable tokens. By November 3, the attacker had consolidated approximately 3,649 ETH (about $8.2 million) into two fresh wallets and was routing funds through multiple bridges including Mayan, Chainflip, and Bridgers.

Mercado Bitcoin has pledged that no customer will lose money, meaning the exchange will absorb the loss itself. The company has not given a date for when deposits and withdrawals will resume.

A Troubling Question: Shared Infrastructure, Shared Vulnerability?

Perhaps the most unsettling aspect of the dual breach is what it implies about the attack surface that connects exchanges. If Bitquery’s attribution is correct — that the same attacker held signing keys for wallets at both Mercado Bitcoin and BitMart simultaneously — then neither exchange was compromised in isolation. The attacker had access to credentials that crossed exchange boundaries.

This points toward a small number of possible explanations. The most concerning is a shared supplier: a custody technology provider, a key management service, or even an individual contractor whose credentials or access tokens covered both platforms. Bitquery raised this possibility explicitly in its analysis, noting that the sequential nature of the attacks “raises the question of a shared supplier.”

It is worth noting that the week’s security headlines did not begin with Mercado Bitcoin. On November 3, the Liquid Network — Bitcoin’s federated sidechain — announced that it had fully restored its 1:1 BTC backing following a $320 million exploit in September, in which an attacker used a bug in Liquid’s Elements software to mint approximately 4,000 unbacked LBTC and drain them through the network. Blockstream, the company that developed the underlying technology, covered the remaining 600 BTC shortfall after rejecting the attacker’s demand for a 10 percent bug bounty. The same week saw the resolution of one crisis and the emergence of another.

What This Means for You

If you hold funds on any centralized exchange, this week’s events are a practical reminder of several things worth taking seriously.

  • Centralized hot wallets remain the highest-risk holding point in crypto. Exchanges keep hot wallets to process withdrawals quickly. Those wallets, by definition, hold accessible private keys. No amount of two-factor authentication on your account protects funds held in an exchange’s own hot wallet.
  • Stablecoin freezing helps — but it is slow and partial. Circle was six hours behind Tether’s first freeze. By then, most movable funds had already been bridged out. A meaningful portion of the stolen money is likely unrecoverable.
  • Multi-chain exposure amplifies losses dramatically. A decade ago, a single-chain drain would have been constrained by what sat on one network. Modern exchanges manage wallets across a dozen chains simultaneously, which means a single set of compromised credentials can sweep everything at once.
  • An exchange in restructuring is a higher-risk counterparty. BitMart’s own founder acknowledged that his security team was understaffed. If you hold assets on an exchange that is in financial difficulty, the security infrastructure is likely under the same pressure.
  • Self-custody remains the safest option for large holdings. Hardware wallets, properly set up, keep your keys entirely out of exchange hands. The tradeoff is that you bear full responsibility for security — but that is a tradeoff that looks more attractive each time an event like this week’s unfolds.

The Bigger Pattern

The Mercado Bitcoin and BitMart incidents sit inside a year that has already set records for crypto theft. The Binance breach in October 2026 — which saw $6.3 billion drained from the world’s largest exchange in a social-engineering attack linked to North Korea’s TraderTraitor group — reset expectations for what the worst-case scenario looks like. The events of November 2 were smaller in absolute terms, but they introduce a qualitatively different concern: not a single catastrophic breach at a single target, but a coordinated attacker moving across multiple platforms in sequence.

The crypto industry has responded to previous hacks primarily by hardening individual exchange infrastructure — adding more multisig, deeper cold storage requirements, more thorough audits. The Mercado Bitcoin breach suggests those measures may not be sufficient if the attack surface extends to shared custody suppliers, shared contractor access, or shared code that sits beneath multiple exchanges at once.

At the opening of this article, an attacker was 26 minutes into draining $49 million from a Latin American exchange while also holding keys to a second exchange being quietly emptied in parallel. That image — methodical, multi-platform, automated — is the shape of the threat the industry now faces. The question of how to answer it has not yet been fully asked.

Sources

Unknown's avatar

Published by jamrockbrown

Published

Leave a Reply