An analysis of on-chain data from Brazil's largest cryptocurrency exchange, Mercado Bitcoin, revealed a troubling detail: the attacker continued withdrawing digital assets from the platform's deposit addresses for approximately four hours after the company's management publicly announced that the hack had been contained. This is evidenced by the results of a technical investigation of transaction flows.
The incident demonstrates the gap between the exchange's official communications and the actual picture on the blockchain. The statement that the attack had been brought under control did not match the actual behavior of the funds: malicious activity on the deposit wallets persisted, and cryptocurrency withdrawal transactions continued to be recorded on the network.
What lies behind the delayed response
Such a scenario points to several systemic problems. First, the speed of detecting anomalies in deposit address flows remains critically low — the attacker maintained control over the withdrawal process for several hours. First, this also calls into question the effectiveness of automatic blocking mechanisms for suspicious transactions and the responsiveness of internal monitoring.
Second, the question arises of transparency in information disclosure. A public statement about containing the incident, made before the malicious activity had actually ceased, creates reputational risks and undermines users' trust in the platform's risk management system.
For holders of funds on centralized exchanges, this case serves as a reminder: official statements about "bringing under control" require independent verification through on-chain data. Transaction activity on the blockchain remains the most objective indicator of the real state of a platform's security.
Cryptalist analysis: The Mercado Bitcoin incident highlights a fundamental vulnerability of centralized platforms — the delay between detecting an attack and its actual neutralization. The market needs a transition to standardized real-time on-chain incident disclosure protocols, since the discrepancy between exchanges' public statements and blockchain data is becoming a systemic risk factor for institutional and retail investors.