Where did Mercado Bitcoin’s stolen bitcoin go?
Summary
On 2 November 2026 Mercado Bitcoin, Brazil’s largest crypto exchange, was hacked. This report covers only the bitcoin part, read transaction by transaction from the blockchain with Flow.
The attacker took 106.07 BTC, worth about $8.1 million at the time. All of it went to one address, 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp, in seven payments between 05:42 and 06:49 UTC. None of it has moved since.
Almost all of it, 104.43 BTC, came from the exchange’s hot wallet in a single payment. That payment was built exactly like the exchange’s own customer withdrawals. The remaining 1.64 BTC came from 64 of its deposit addresses, in transactions built quite differently: like the exchange’s own transfers out of its main wallet, but with a fee 10 to 50 times higher. The two styles suggest the attacker could use the exchange’s payout system and also held the private keys to its deposit addresses. The blockchain shows how the coins moved. It cannot show how the attacker got in.
The bitcoin side was finished by 06:49 UTC, 03:49 in Brasília, before the working day began in Brazil.
What happened, in order
The bitcoin theft took four and a half hours, in four steps. The chart shows when each transaction was confirmed. Hover over a mark for details.
- 02:15–02:30 · old addresses emptied. Three transactions moved 17 coins from 10 deposit addresses of the exchange’s main wallet into a new address, E (0.369 BTC). In Brasília it was 23:15 on Sunday.
- 05:42 · first payment to the hacker. E paid everything it held to H in two transactions. This is the first time H appears on the blockchain.
- 06:19 · deposit sweep. A test payment of 0.0001 BTC from one deposit address, then one transaction that swept 86 coins from 53 deposit addresses into H (1.2695 BTC), both in the same block.
- 06:41–06:49 · hot wallet drained. Another 0.0001 BTC test, then a single payment of 104.42787649 BTC from the hot wallet M1, then its last 0.00086 BTC eight minutes later.
As of block 974,874 (7 November, 01:30 UTC), the 106.07 BTC at H has not moved.
Where the 106.07 BTC came from
| Source | Step | Coins | Addresses | BTC to H |
|---|---|---|---|---|
| Hot wallet M1 | Test, payout and leftover, 06:41–06:49 | 36 | 3 | 104.42884083 |
| Deposit addresses of M0 | Test and sweep, 06:19 | 87 | 55 | 1.26962011 |
| Old addresses of M0, via E | Staged 02:15–02:30, paid on 05:42 | 17 | 10 | 0.36933907 |
| Total | 106.06780001 |
The test at 06:19 spent one deposit address. The sweep that followed has 54 input addresses: 53 deposit addresses plus the change address of the test. Its 86 coins had arrived in 75 different blocks. With the 10 addresses emptied at 02:15, the attacker took coins from 64 deposit addresses.
The 0.0001 BTC test from the hot wallet spent a coin sent to a Mercado Bitcoin deposit address from Bitfinex 72 minutes earlier, at 05:29. The hot-wallet software does this in its normal withdrawals too: six times in the day before the hack it paid a withdrawal from a fresh deposit address and sent the change to the hot wallet. The test ran through the same routine.
Two tools, two kinds of access
Wallet software leaves marks on every transaction it builds: a version number, a lock time, whether the fee can later be raised, and how the fee is set. We compared the hacker’s transactions with the hot wallet’s 70 ordinary payouts from 10:08 UTC on 1 November until the hack, and with the main wallet’s own spending since June.
| Mark | Exchange’s normal payouts (70) | Hack: hot-wallet and E payments (5) | Hack: deposit sweep (2) | Hack: 02:15 staging (3) |
|---|---|---|---|---|
| Version | 1 | 1 | 2 | 2 |
| Lock time | none | none | previous block (974,219), a common protection | none |
| Fee can be raised later | no | no | yes | yes |
| Fee rate | 1.2–6.0 sat/vB, median 2.4 | 1.2–4.6 sat/vB | exactly 50.0 sat/vB | 1.7–2.0 sat/vB |
| Shape | one or a few inputs, payment plus change | same; change, when any, back to the hot wallet | sweep: 86 inputs of three address types, one output | 3–7 inputs, one output |
| Built like the exchange’s own | – | hot-wallet payouts | main-wallet transfers into the hot wallet, July–September (13), which paid 1–5 sat/vB | main-wallet spending up to 21 July (its last 1,030 payments), mostly at 5 sat/vB |
The hot-wallet theft looks like a normal withdrawal
The 104.43 BTC payment has every mark of the exchange’s own payouts, down to the fee rate and the change going back to the hot wallet’s main address. Either the attacker sent a withdrawal through the exchange’s own payout system, or used the same signing software with the hot wallet’s keys. The blockchain cannot tell these apart. Either way, the attacker reached the exchange’s own systems.
The deposit sweep uses the main wallet’s tool
The sweep differs from every hot-wallet transaction we examined. It is version 2, carries the previous block as its lock time and can have its fee raised. Those are the marks of the exchange’s own 13 transfers from its main wallet into the hot wallet between July and September, which also gathered many inputs into one or two outputs, each at a round fee set by hand: 1, 2 or 5 sat/vB. The sweep set exactly 50 sat/vB: the sender paid for speed. Spending 53 deposit addresses of three different types in one transaction needs the private key of each one, or the master key they come from. That points to wherever the exchange keeps those keys, not to the payout system.
The 02:15 staging carries the marks of the main wallet’s spending up to 21 July, when the exchange switched to its new transfer tool: version 2, no lock time, a fee that can be raised. Before it, the main wallet had made no payment at all since 24 September.
Why H is the hacker’s address
On the day of the hack the hot wallet, which had been paying customer withdrawals in the usual way, sent its entire balance to H, an address never seen before. The same address took a sweep of 53 of the exchange’s deposit addresses at a fee far above anything the exchange paid. No withdrawal of the exchange looks like either.
About the hacker
The blockchain cannot say who the attacker is. It does show what they could reach and how they worked.
Two kinds of access
- The exchange’s payout system. The 104.43 BTC payment was signed by the same software that signs Mercado Bitcoin’s customer withdrawals, and it reached the network by the same route. Network data adds a detail: the exchange’s ordinary payouts go out on a fixed ten-minute schedule, and the 06:41 test and the 104.43 BTC payment did not. They appeared between scheduled runs, which may mean the signer was triggered directly rather than through the normal withdrawal queue. The last 0.00086 BTC appeared on schedule.
- The deposit addresses’ private keys. The sweep spent 53 deposit addresses of three types in one transaction, built like the exchange’s own main-wallet transfers, with the fee set by hand at 50 sat/vB. That needs the keys themselves, or the master key they come from, which a payout system does not normally give out.
Having both is a great deal of access to one exchange, and both tools match software the exchange itself used: its payout system for the hot wallet, and its main-wallet transfer tool for the sweep. The attacker worked through the exchange’s own systems.
A careful operator
- A 0.0001 BTC test before each large spend, at 06:19 and again at 06:41.
- Night hours in Brazil: the staging began at 23:15 on Sunday, Brasília time, and the bitcoin side was finished by 03:49.
- Every coin went to one fresh address, untouched for five days.
How they got in
The blockchain cannot show how the attacker gained this access, only what it allowed them to do.
What only the exchange can answer
- Does its withdrawal system hold a record of the 104.43 BTC payment at 06:41? If not, the signer was called directly, and its logs will show from where.
- Was the last 0.00086 BTC payment a queued withdrawal? If so, the order carries an account or an API key.
- Where are the deposit-address keys kept, and what could export them? Which systems run the tool that moved coins from the main wallet to the hot wallet between July and September? The 50 sat/vB sweep was built like those transfers.
- Was the 02:15 staging, the main wallet’s first payment in 39 days, the exchange’s own housekeeping or the attacker’s first move?
The hacker’s address
The network view
The hot wallet’s payments to the hacker reached the Bitcoin network through the same connection that first carried many of the exchange’s ordinary payouts in the previous 24 hours. That fits the finding above that they came out of the exchange’s own systems. The deposit sweeps and the 02:15 staging first appeared through unrelated public connections, and nothing in the network data points to the attacker’s own connection.
Network details are kept off this page.
What to watch
- The address H. When the 106.07 BTC moves, its first destinations are the best chance to freeze it. Exchanges should flag any deposit traced back to 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp.
- The same signature. A sweep at exactly 50 sat/vB, with the previous block as its lock time and many inputs of mixed types paid to a single legacy address, is a distinctive pattern if it turns up again.
Limits of this trace
- Wallet ownership is our assessment, not confirmed by Mercado Bitcoin.
- The blockchain cannot show whether the 02:15 staging was the attacker’s first move or the exchange’s own housekeeping. The address it filled paid the hacker three hours later, and it was the main wallet’s first payment in 39 days.
- “The exchange’s payout system” and “its signing software” are two readings of the same evidence. The ten-minute schedule favours the second, but only the exchange can tell which is right.
- Amounts in dollars use the bitcoin price at the time of each payment.
How to read this report
Every finding can be checked
Each one is tied to public on-chain data, with the transactions listed so anyone can verify them.
Confidence is stated
Where we link activity to a person or group, we say how confident we are and why. Those links are our assessment, not a finding of guilt.
AppendixTransaction register
Every bitcoin transaction in this report, in order. Select to expand.
| Time · block | Step | Transaction ID |
|---|---|---|
| 02:15 · 974,198 | M0 → E, staging (7 coins) | 2e64077238eebfe778008c6cc056209ad5c6961aa61cd6c9c6287ebf07b83596 |
| 02:30 · 974,200 | M0 → E, staging (7 coins) | 1ac1d2fdb486f521917158ab16cdb616445fcd7682bb553ae4e8b94ff57c8d01 |
| 02:30 · 974,200 | M0 → E, staging (3 coins) | 5eb6ff2d4034746dcd5e4cb973582753f84117355163ba94c8db93adf1755503 |
| 05:42 · 974,216 | E → H, 0.0007272 BTC | 85d08d7f5c0165a92caabd7a4c9277b3b971dd9e72740f8223fb235a519b1cb2 |
| 05:42 · 974,216 | E → H, 0.36861187 BTC | afda480aa8376a073b173d32e4cdb61ffa60076063ff094c62782a35f6e777a7 |
| 06:19 · 974,220 | Deposit address → H, test 0.0001 BTC | 643b3ad9b3615932109e2256b9cb2a0d1daa636b0250155aba36fe257340bc75 |
| 06:19 · 974,220 | 53 deposit addresses → H, 1.26952011 BTC | aa9bc710f06286911921acf778e0010ed98b3e5032abe553470b9e09e9e96239 |
| 06:41 · 974,223 | Deposit address → H via the hot-wallet routine, test 0.0001 BTC | 7f65ae37cb4f1e7ddbac62ec85f68b64088fd1f2a340fbcf8e81635e79923ecc |
| 06:41 · 974,223 | Hot wallet → H, 104.42787649 BTC | ada3bb2304be5de8dd7e67bf9be8c765c5f020a34508bd248f345a1205c5fcf9 |
| 06:49 · 974,224 | Hot wallet → H, 0.00086434 BTC | 44432ef89446564176204bfac68501ffc68d5f7703278d686da5af847931a722 |
About BlockTrace
BlockTrace provides digital asset monitoring and incident response for exchanges, custodians, protocols, funds and any business that holds digital assets, working as an extension of their security teams. Its work covers readiness, monitoring, incident response, and fund tracing and reports, on Bitcoin, Ethereum and EVM chains, Solana and Tron. Every message is triaged around the clock, and urgent incidents reach a person at any hour.
BlockTrace published this report free of charge, with no commercial arrangement with Mercado Bitcoin or anyone else, and built it with Flow by FollowTheSats.
blocktrace.comServicesHow we workActive incidentIndividual reportsIf you’ve been hackedContact form