Mercado Bitcoin attacker drained 13,442 addresses after all-clear

At 9:56 Brasília time on 2 November, 12:56 UTC, Mercado Bitcoin said it had identified and swiftly contained a security incident in one of its systems overnight.Mercado Bitcoin update 9h56 2 Nov. The same statement said there had been no harm to customers and no data leak, and that deposits and withdrawals were suspended as a precaution.

The blockchain kept moving. The S-Curve’s count of public transaction data finds that between 12:10 and 17:00 UTC that day, 36,060 different addresses sent ETH to the attacker’s main address.Mercado Bitcoin deposit sweep on Ethereum, own count summary. Of those, 13,442 first paid the attacker at or after 12:56 UTC, the time of the exchange’s statement. Bitquery, an on-chain analytics firm, reaches a similar figure by its own method: 36,042 Mercado Bitcoin deposit addresses on Ethereum that sent their whole balance to the attacker between 12:27 and 16:56 UTC.Bitquery: Mercado Bitcoin hack investigation.

The sums in those addresses were tiny. What the count shows is reach: the attacker could move money out of tens of thousands of customer addresses, hours after the exchange said the incident was contained.

What was taken

The first losses came from the exchange’s own hot wallets, the online wallets that pay out withdrawals. Bitquery says the Ethereum hot wallet paid the attacker $29.5 million in 24 minutes from 06:24 UTC, and that hot wallets across 10 chains paid out in about 25 minutes. Bitquery puts the total theft at $48.6 million across 11 chains, valued at the time of each transfer. It says the exchange has given a lower figure, about $36 million to $38 million, and that Chainalysis says about $49 million.

Mercado Bitcoin’s FAQ says the incident hit only its hot wallets, and that most assets sit in offline cold wallets.Mercado Bitcoin FAQ on the incident. The exchange says no customer will lose assets,Mercado Bitcoin update 4 Nov 18h40. that it is already replacing the affected assets with its own funds, and that customer balance records are preserved. On 4 November it said assets equivalent to more than US$15 million were already blocked. It says the part not yet recovered is about 3% of all assets it holds in custody.

Freezes came early. Chainalysis, whose customers include the exchange, says one of the exchange’s directors phoned its in-country expert at 2:30 a.m. Eastern (07:30 UTC), and that within 30 minutes it had contacted law enforcement to relay freezable addresses.Chainalysis: Disrupting the Mercado Bitcoin Attack. Bitquery says Tether froze first, at 10:21 UTC, before the exchange’s public statement. It says five stablecoin issuers have frozen $11.8 million, about 24% of the total, and that most of the rest sits in assets such as bitcoin and ether that no issuer can freeze.

Two kinds of wallet

An exchange runs two kinds of wallet. Hot wallets pay withdrawals. Deposit addresses are different: each customer gets one per chain, and the exchange holds the keys. Custody vendor Fireblocks describes the routine in its developer documentation: when a deposit address receives tokens, the exchange pays network fees into it so the tokens can be swept to central wallets.Fireblocks: sweep funds.

The swept addresses here were of that second kind. Bitquery says each one signed its own transfer of its whole balance. It checked a random sample and found that every address with earlier activity had paid the exchange’s own hot wallets, which marks them as customers’ deposit addresses. Later, Bitquery says, the attacker used addresses still holding ETH to pay network fees for others, so their tokens could be taken too.

Each address held little. Bitquery counts 36,042 addresses worth $266,000 in all. Of those, 91% held less than $10, and the 113 holding $100 or more had 61% of the money. In our ETH-only count, the addresses together sent 53.25 ETH, of which 19.29 ETH moved at or after 12:56 UTC.

So the sweep was not about the money in the addresses. It shows that whoever did this held the means to sign for them.

One key behind many

Why would one intruder control that many addresses? Bitquery says exchanges usually make all deposit keys from one master key, so the attacker can most likely sign for any of them. That follows from the standard most wallets use. Under BIP-32, the specification for hierarchical deterministic wallets, knowing an extended private key allows reconstruction of all descendant private keys and public keys.BIP-32 Hierarchical Deterministic Wallets.

Not every custodian works this way. BitGo, another custody provider, says it uses a forwarder smart contract to give one wallet many receive addresses, a design without a separate key for each address.BitGo: EVM consolidations. The exchange has not said which design it uses.

How the attacker got in is not known. Bitquery says it does not know and the exchange has not said. It adds that the pattern fits a way into the exchange’s own payout system plus the deposit keys, but the chain alone cannot prove it.

Rekt, a crypto security publication, makes the practical point this way: “Disabling a payout system can stop requests that run through it. It does nothing to a private key someone else already holds.”Mercado Bitcoin - Rekt. Decrypt wrote that the exchange’s public updates have not explained the gap between its containment claim and the later transfers.Decrypt: hack continued after contained.

What the exchange says, and what it has not said

The exchange’s FAQ says it does not comment on details of its investigation, to preserve it. It says crypto sent to a valid Mercado Bitcoin address during the outage will be credited when transfers resume. Its 4 November update set a gradual reopening from 9 November. The FAQ does not say whether old deposit addresses will be replaced.

Other exchanges have faced the question. After its September 2023 hack, CoinEx said a hot-wallet private key had leaked.CoinEx incident notice 2023. When it reopened, it issued new deposit addresses to every user and declared the old ones no longer valid. Bitquery’s advice for Mercado Bitcoin customers is not to send coins to an old deposit address until the exchange says it is safe, and to expect new ones.

The open question

Rekt reports that, six days before the attack, Mercado Bitcoin filed its application to Brazil’s central bank for authorization to provide virtual-asset intermediation and custody on 27 October, ahead of a 30 October deadline.

BitMart was hit too. Its founder, Sheldon Xia, said BitMart was hacked on 2 November as well, called the amount small, and said its early investigation points to the same group.crypto.news: BitMart confirms hack.

The exchange can answer the question the chain cannot: whether the keys behind its customers’ deposit addresses have been replaced.