Hackers continued to loot Mercado Bitcoin for hours after reporting that the hack had been contained

The hackers who recently seized tens of millions of dollars at the Brazilian crypto exchange Mercado Bitcoin were able to last much longer than expected.

New research shows that the attackers continued to steal crypto coins for hours after the trading platform reported that the attack was under control. In addition, there are indications that the same perpetrators have also hit a second crypto exchange.

Blockchain analytics firm Bitquery has been investigating the transactions surrounding the November 2 cyberattack. This reveals a striking difference between the moment when Mercado Bitcoin considered the attack to be controlled and the moment when the theft actually stopped.

The crypto exchange reported on 2 November at 13:56 Dutch time that the attack had been contained. However, the blockchain data shows that the hackers continued to lock out crypto coins until 17:56.

The attackers had already started clearing addresses on the Ethereum (ETH) network at 1:27 pm. A total of 36,042 addresses were affected which clients used to deposit crypto coins into their trading account.

The fact that the theft continued for another four hours after the official report raises questions about the speed with which Mercado Bitcoin actually got the attack under control.

According to Bitquery, the transactions indicate that the hackers may have had access to systems with which the crypto exchange manages customer deposits. This would have allowed them to funnel money away for a longer period of time, despite the measures the company had taken.

The investigation also reveals new information about the extent of the damage. Bitquery has now identified $48.6 million in stolen crypto coins, spread across ten different blockchain networks. Previously, it was assumed to be around 40 million dollars.

The researchers also discovered a possible connection to another cyber attack. The same hackers also seem to have been involved in a hack of crypto exchange BitMart.

A crypto address attributed to the attackers received money from various addresses on the networks Base, Arbitrum and Optimism even before the attack on Mercado Bitcoin.

Bitquery suspects that these addresses belong to BitMart. Through these transactions, about $391,000 would have been stolen, although BitMart has not yet confirmed that amount.

Founder Sheldon Xia did confirm that his crypto exchange was hacked on November 2. According to him, the preliminary investigation indicates that the same group is behind both attacks.

This possible involvement raises new questions. It is conceivable that the hackers gained access to technical infrastructure used by multiple crypto exchanges. This would allow them to attack different trading platforms without having to find a completely new vulnerability every time.

However, there is no evidence for that statement for the time being. How exactly the attackers penetrated and whether both incidents actually have the same cause remains unclear.

As the investigation into the hackers continues, Mercado Bitcoin is trying to limit the impact on its customers. The crypto exchange has promised to compensate all losses of affected users.

The company also received help from Tether, Circle and blockchain analytics company Chainalysis. This collaboration has now resulted in the freezing of more than $15 million in stolen crypto coins.

Deposits and withdrawals are still not possible for users for the time being. Mercado Bitcoin wants to make its website accessible again on November 9, but customers will only be able to view their data and credits.

It is not yet known when users will be able to deposit or withdraw crypto coins again. Mercado Bitcoin has not yet responded to Bitquery's new findings.