An attacker drained Mercado Bitcoin-linked deposit addresses for nearly four hours after the Brazilian exchange announced it had contained a security breach, according to new blockchain research.

Blockchain analytics firm Bitquery's updated analysis traces more than $48 million in stolen assets across 11 blockchains, putting the total at $48.6 million — above Mercado Bitcoin's latest estimate of about $36.3 million. Its findings challenge the exchange's claim that it stopped the attack quickly.

The exchange announced at 9:56 a.m. Brazil time on November 2 that it had quickly contained the incident. Bitquery's data shows 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time — meaning the transfers began roughly half an hour before the announcement and continued for nearly four hours afterward.

Those addresses held roughly $266,000, a small fraction of the total theft. Even so, the attacker was able to move the funds well after the exchange said the breach was under control.

A customer deposit address works much like a personal receiving account for cryptocurrency. The exchange later gathers those coins into a shared online wallet, known as a hot wallet, to process everyday transactions. Moving funds from a deposit address requires its private key — the secret that authorizes transfers.

Bitquery says the withdrawals were authorized directly by the deposit addresses, suggesting the attacker had access to their private keys or to a system capable of signing transactions on their behalf.

"That needs a key for each address, or a way into the system that signs for them," the researchers explained. They warned that exchanges typically generate deposit keys from a single master key, meaning the attacker may still be able to access other customer addresses.

The size of the theft is also disputed. Initial estimates put the amount above $40 million, while Mercado Bitcoin's updated FAQ now places affected assets at about $36.3 million. Bitquery maintains that $48.6 million was stolen across 11 blockchains.

The exchange's public updates have not explained the gap between its containment claim and the later transfers. The company has assured customers it will cover user losses with its own funds. Until the competing tallies are reconciled, though, the full scope of what it has pledged to cover remains unsettled.

Bitquery is warning customers not to reuse old deposit addresses until the exchange confirms they are safe. Mercado Bitcoin's reopening plan begins November 9 with balance viewing only; deposits, withdrawals, and trading currently have no restart date. That schedule leaves several open questions for customers watching the exchange's next updates: when the attacker's access was actually cut off, how the disputed totals will be resolved, and whether old deposit addresses will be cleared for reuse before core services return.