Mercado Bitcoin claims to have contained the hack that targeted its platform on November 2. Yet Bitquery’s analysis reveals that thousands of deposit addresses lost their funds after this announcement. Researchers tracked $48.6 million in assets across eleven blockchains. This timeline questions the actual timing of the lockdown and the extent of access obtained by the attacker, particularly to funds linked to bitcoin. It highlights the limits of the first initial public information.
In brief
- Bitquery reveals that 36,042 Ethereum addresses were dumped after hack containment announcement.
- The investigation traces $48.6 million in stolen cryptocurrencies across eleven blockchains.
- Researchers suspect access to private keys or a flaw in the authentication system.
- Mercado Bitcoin promises to reimburse customers and plans a gradual recovery from November 9.
Bitquery traces transfers after announcement
The platform announced on November 2, at 9:56 a.m., that it had brought the incident under control. However, Bitquery locates movements after this communication. 36,042 Ethereum deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Transfers continued almost four hours after the announcement.
These addresses contained approximately $266,000, a small portion of the estimated amount. Dumping these addresses remains important to understand the timeline. Data shows that the hacker was able to move funds after theannouncement from Mercado Bitcoin. They relate to client deposits, not just a central wallet.
A deposit address receives cryptocurrencies from a customer. The platform aggregates assets into a shared hot wallet for day-to-day operations. Each transfer requires a private key. Here, the withdrawals appear to have been authorized directly by the affected addresses, according to theBitquery analysis.
The private keys of bitcoin at the heart of the questions
This method suggests that the attacker had the private keys or a system capable of signing on behalf of clients. The researchers suggest two options: obtaining a key for each address or exploiting an authentication flaw. The analysis does not decide. It highlights a risk linked to the architecture of the repositories.
Platforms generate deposit keys from a single master key. If this key or the associated system has been compromised, access could exceed flushed addresses. Bitquery warns that other deposits could remain exposed. This hypothesis also concerns addresses linked to bitcoin, even if the movements described relate to Ethereum.
Researchers recommend not reusing old addresses until official confirmation of security. This instruction aims to avoid further transfers to vulnerable addresses. For bitcoin holders, caution involves verifying the platform’s information before any transaction.
The amount of the theft and the resumption of services remain to be clarified
The financial evaluation varies depending on the communications. The first estimates mentioned more than 40 million dollars stolen. Mercado Bitcoin’s updated FAQ brings the amount to around 36.3 million. Bitquery estimates stolen assets at $48.6 million across eleven blockchains.
The difference between these assessments exceeds twelve million dollars, without public explanation. Mercado Bitcoin does not detail why transfers continued after the declared confinement. The company, however, assured that it would reimburse users’ losses with its own funds. This promise concerns the losses of its customers.
The platform plans to resume on November 9. Customers will first be able to view their balances. Deposits, withdrawals and transactions will remain unavailable at this stage. This limited opening will precede the restoration of services, while users await clarification on their holdings.
What happens next will depend on the verifications and reopening announced by Mercado Bitcoin. The platform will have to specify whether the old addresses are secure. Until then, customers must follow these instructions and avoid any deposits to an unconfirmed address. The results remain to be established.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
