New blockchain forensic analysis directly contradicts Mercado Bitcoin's assertion that a sophisticated security breach affecting the Brazilian cryptocurrency exchange had been successfully contained. While the platform publicly announced on Monday that it had stopped the breach, fresh on-chain investigation reveals a starkly different reality: thousands of customer deposit addresses continued to be drained hours after that declaration, according to Decrypt.
The forensic analysis traces the movement of approximately $48.6 million in stolen digital assets across 11 different blockchains. This data indicates that the security incident persisted well beyond the exchange's stated timeline for containment. Specifically, the analysis found continued drainage activity affecting thousands of individual customer deposit addresses in the hours following Mercado Bitcoin's announcement that it had halted unauthorized access and secured its systems.
The discrepancy between the platform's official communications and the immutable blockchain record raises significant questions regarding the true scope and timeline of the compromise. The exchange indicated on Monday that technical teams had successfully stopped the breach, yet the on-chain evidence demonstrates that customer funds remained vulnerable to extraction well after that public assurance. The continued activity suggests that either the threat actors maintained persistent access to withdrawal infrastructure, or that the initial security assessment failed to identify all active attack vectors.
The distributed nature of the theft across 11 distinct blockchain networks points to a sophisticated operation with the capability to navigate diverse cryptographic ecosystems. The identification of thousands of drained customer deposit addresses indicates systematic, wholesale access to the exchange's deposit infrastructure rather than isolated wallet compromises. This breadth of access complicates recovery efforts and forensics, as security teams must track stolen assets across nearly a dozen different chains with varying levels of transparency.
The $48.6 million theft represents a substantial compromise, and the revelation of continued drainage past the claimed containment date alters the understanding of the incident's severity. The hours-long gap between when Mercado Bitcoin stated the breach was stopped and when blockchain evidence shows funds actually ceased moving suggests a significant delay in either detection or remediation.
For affected customers, the blockchain data creates uncertainty regarding the final calculation of losses and the current security status of any remaining assets on the platform. The forensic analysis serves as a concrete record that contradicts the exchange's initial timeline regarding when the breach was neutralized. Security researchers emphasize that such on-chain verification remains essential when assessing custodial platform breaches, as blockchain records provide immutable evidence of fund movements that operate independently of corporate communications. The analysis demonstrates that despite public assurances of containment, the mechanical reality of continued outgoing transactions persisted for hours, potentially expanding the scope of the $48.6 million loss.