Mercado Bitcoin Recovery and the 106 BTC Trail

Two small Bitcoin payments reveal more of the Mercado Bitcoin incident than their amounts suggest. Each sent 10,000 satoshis to the incident collector, then left a separate output that a larger transfer spent. Those exact links connect the small payments to an 86-input sweep and the main 104.43 BTC transfer.

The collector still held 106.06780001 BTC in seven unspent outputs at our November 10, 01:00 UTC snapshot. Activity on Ethereum continued separately: the exchange-disclosed Ethereum address requested a Lido withdrawal on November 9 and later sent two tokens to another address. The Bitcoin balance cannot support a claim that all incident funds have stopped moving.

The incident addresses come from Mercado Bitcoin's November 2 disclosure. Transaction evidence and ownership attribution remain separate questions.

Account viewing has returned, withdrawals have not

Mercado Bitcoin's incident FAQ, checked November 10 UTC, describes a gradual return of account viewing on November 9. Its first phase still excludes trading, deposits, withdrawals and cryptocurrency transfers. Website users can inspect asset details, while the app initially shows a portfolio summary. API access will return later.

The displayed positions and their Brazilian-real valuations refer to the moment before the November 2 incident. These historical records do not show whether the exchange can settle withdrawals. The FAQ says a later phase will allow Pix withdrawals to accounts in the customer's own name and CPF, following registration checks and a password reset. It does not give a reopening date for cryptocurrency transfers.

The company says it will replace affected assets with its own resources. Its FAQ reports more than 33% of stolen assets blocked and describes the unrecovered amount as approximately 3% of assets under custody. We have not independently audited those figures. This review did not include an authenticated customer account or a withdrawal test.

Blocked assets and recovered money are different

The exchange's November 4 update reported more than $15 million in blocked assets and promised replenishment. Blocking can prevent further transfers without returning an asset to its owner. Our guide to blockchain fund freezes explains that distinction.

The Record's November 2 report attributed an outflow estimate above $46 million to blockchain security companies. It said Mercado Bitcoin had not confirmed that figure and described disagreement over whether customer deposit addresses were affected.

Outflow estimates, frozen tokens, outstanding losses and replacement funding measure different things. Adding the freeze figure to the outflow estimate could count the same assets twice. The reviewed sources leave the final audited loss, complete recovery total and initial access method unresolved.

Seven Bitcoin receipts, no collector spend at the snapshot

The exchange identified 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp as an incident destination. Blockstream and mempool.space agreed on seven confirmed receipts totaling 106.06780001 BTC, zero spent outputs and no pending transaction. We fetched those records between 01:00:06 and 01:00:19 UTC on November 10, 2026, with both services reporting chain tip 975,230.

A Bitcoin transaction spends earlier outputs and creates new ones. Each output assigns an amount to spending conditions. For the payments traced here, an address identifies those conditions. An address can receive many outputs that a later transaction spends together, so an input count cannot tell us how many people are involved.

All seven collector receipts confirmed on November 2. The amounts below exclude fees and outputs sent elsewhere.

Block	BTC received	Transaction and path
974,216	0.00072720	85d08d7f5c01… · Intermediate address
974,216	0.36861187	afda480aa837… · Intermediate address
974,220	0.00010000	643b3ad9b361… · Small payment linked to the sweep
974,220	1.26952011	aa9bc710f062… · 86-input consolidation
974,223	0.00010000	7f65ae37cb4f… · Small payment linked to the main transfer
974,223	104.42787649	ada3bb2304be… · Largest payment
974,224	0.00086434	44432ef89446… · Follow-up from the main transaction

An unspent balance does not reveal who currently holds the keys. It cannot distinguish attacker control, investigator control or lost access. It also cannot show whether the exchange has reimbursed customers. Anyone can send to a public address, so a recipient's total alone does not establish the origin of every receipt.

The first small payment is an input to the 86-input sweep

The first 10,000-satoshi payment spends 68,211 satoshis. It sends 10,000 to the collector, leaves 50,861 satoshis at output index 1, and pays a 7,350-satoshi fee. Output indexes start at zero.

The 86-input sweep spends that exact output. The transaction ID and index identify the connection directly, without assuming that addresses belong to the same wallet. The sweep delivers another 1.26952011 BTC to the collector and pays 335,100 satoshis in fees.

The 50,861 satoshis connect the transactions. They are not another collector receipt.

This also resolves the difference between two published address counts. The sweep has 54 distinct input addresses, but one is 188D3qQ55JMkciRexbtGFvNULCkCAJxZ1h, the address receiving the small payment's other output. Removing that intermediate address leaves 53 other addresses. That count is consistent with the 53 deposit addresses described in Bitquery's investigation. The arithmetic does not independently verify Bitquery's ownership labels or establish 53 customers.

Both transactions confirmed in block 974,220, whose header time is 06:19:20 UTC. This resembles a small payment followed by consolidation, but the chain does not tell us its purpose. Confirmation in the same block does not show that someone waited for a successful confirmation before sending the larger amount.

The second small payment feeds the 104.43 BTC transfer

The other 10,000-satoshi payment spends 200,000 satoshis. After its collector output and 173-satoshi fee, it leaves 189,827 satoshis at output index 1 for bc1q6gd5r4rdepytytc065dt8jxmyhfxawuc5nzfa5.

The main transfer consumes that output among 34 inputs from two addresses. It pays 104.42787649 BTC to the collector, returns 86,952 satoshis to the same source address and pays 2,875 satoshis in fees. Both transactions confirmed in block 974,223, timestamped 06:41:47 UTC.

The next-block transfer spends the remaining source output, not the 104.43 BTC already at the collector.

The follow-up transaction spends those remaining 86,952 satoshis. Of that amount, 86,434 reaches the collector and 518 pays the fee. It confirmed in block 974,224, timestamped 06:49:19 UTC. Including the initial small payment, this connected chain contributes three collector outputs totaling 104.42884083 BTC.

Different fee rates and transaction settings

The two chains use markedly different settings. Both transactions in the 86-input chain pay exactly 50 satoshis per virtual byte. The second small payment and the main transfer pay about 1.20 and 1.21 sat/vB, respectively. Bitcoin fees depend on transaction size, measured in virtual bytes. Dividing the fee by that size makes differently sized transactions comparable.

Field	86-input sweep	Main 104.43 BTC transfer
Fee	335,100 satoshis	2,875 satoshis
Virtual size	6,702 vB	2,384 vB
Fee rate	50 sat/vB	1.205956 sat/vB
Transaction version	2	1
Locktime	974,219	0
Input sequence	0xfffffffd	0xffffffff

Locktime and sequence are transaction fields that can constrain when a spend is valid and signal replacement behavior. The sweep's sequence value meets the explicit opt-in replacement condition in BIP 125. These fields do not identify who signed the transaction or what software they used.

For context, we compared ten earlier outgoing transactions involving bc1qqxu9yyeumd7n73z495n5q230sas5rw933av379, the main transfer's other source address. These came from the explorer's latest 25-record address history and confirmed between October 23 and October 30. All ten used version 1, locktime zero and 0xffffffff input sequences, matching the main transfer. Their fee rates ranged from approximately 1.20 to 6 sat/vB. Examples include the October 23 transaction and October 30 transaction.

The version, locktime and sequence values match earlier sampled spends from one source address.

Different construction settings could reflect different software, configurations or transaction paths. The earlier matches provide a comparison for the main transfer, but cannot prove that an attacker used an exchange withdrawal system. We have not established the purpose or operator of every earlier transaction, and the differing settings cannot establish that two attackers operated the two chains.

The trail begins before the collector's first receipt

An earlier branch runs through 1FGkTXZNE5FfHGXNtS88e1SeGsnY77iSWX. Three transactions collect 0.36934607 BTC from 17 inputs across ten addresses. The earliest traced transaction confirmed in block 974,198 at 02:15:10 UTC. The other two confirmed at 02:30:58.

Two later payments forward 0.36933907 BTC to the incident collector at 05:42:34, leaving 700 satoshis in forwarding fees. The traced staging begins 3 hours, 27 minutes and 24 seconds before the collector's first receipt, according to block times.

Starting an investigation at the collector alone would miss that earlier activity. It still would not be correct to call 02:15:10 the start of the intrusion. Miners supply Bitcoin block timestamps, and confirmation time is neither broadcast time nor evidence of initial system access.

Ethereum activity continued on November 9

Mercado Bitcoin's address disclosure also identifies 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478. We checked three November 9 transactions from that address against Blockscout's transaction data and Etherscan's records.

At 10:23:11 UTC, a successful withdrawal request transferred 9.348923275430357654 stETH to Lido's withdrawal queue. stETH represents staked ether in Lido. The transaction created request 141198 and assigned its withdrawal NFT to the same incident address. The NFT represents the request's claim rights, not a separate payment of that amount.

Lido's contract documentation distinguishes requesting a withdrawal, finalizing it and claiming ether. This transaction establishes the request. By itself, it does not establish a completed ETH payout or cash-out. We did not verify the request's current finalization or claim status.

A request receipt and two later token transfers are separate events. None establishes that customers recovered funds.

At 10:47:11 UTC, the address sent 22.069956190163935018 Render tokens on Ethereum to 0xddE9c7e14736b94b172A29Ed7c0098F1C9b022dD. Twelve seconds later, in the next block, it sent 6 GUSD to that same recipient. The token contracts are 0x6De037ef9aD2725EB40118Bb1702EBb27e4Aeb24 for Render and 0x056Fd409E1d7A124BD7017459dFEa2F387b6d5Cd for GUSD.

The repeated destination and close timing establish a common recipient for those two transfers. They do not establish who owns that address or why the transfers occurred. We found no verified Bitcoin-to-Ethereum transfer connecting these observations to the unspent Bitcoin outputs.

The BitMart comparison remains an attribution lead

In a November 3 statement, BitMart founder Sheldon Xia reported a hack the previous day and said a preliminary investigation suggested the same group might be involved in the Mercado Bitcoin incident. His statement described an investigative suspicion. It did not confirm a shared cause.

Bitquery's report describes transfers from addresses it labels as BitMart wallets to the same disclosed EVM recipient. This supplies a reason to compare the incidents beyond their timing. We did not independently reconstruct those BitMart transfers, and our attempted Arbitrum explorer API access returned HTTP 403.

The evidence reviewed here does not establish a shared custody supplier, a common exploit, an identified attacker group or a connection to other exchange thefts. Similar consolidation patterns alone would be too common to support those conclusions. A stronger case would need independently verified source-wallet ownership and evidence connecting the affected systems.

Evidence, verification and remaining gaps

We matched Bitcoin transaction IDs, inputs, outputs, fees and confirmation fields across Blockstream and mempool.space. We checked the parent transaction ID and output index for each link between collector-paying transactions, then checked the providers' output-spending records. Integer satoshi calculations reconcile the seven receipts to the address total. The ten earlier comparison transactions also matched across providers. Esplora's API documentation defines the fields used.

The Ethereum checks matched the successful transactions, sending address, destination contracts, token amounts and timestamps across Blockscout and Etherscan. Blockscout's separate logs endpoint failed for the Render transfer, but its transaction response and Etherscan both exposed the transfer. The Lido request event and NFT receipt were available. We did not run a local Bitcoin or Ethereum full node for this review.

Observation	What it establishes	What it does not establish
Exact Bitcoin output links	Each small payment supplies an input to a larger spend	Purpose of the small payment
54 input addresses minus one intermediate address	53 other addresses in the sweep	53 customers or verified deposit ownership
Different fee and transaction settings	Two observed construction patterns	Two attackers or a named wallet product
Seven unspent collector outputs	No observed collector spend at the snapshot	Reimbursement or current key ownership
November 9 Ethereum transactions	Later activity from a disclosed incident address	Bitcoin movement, cash-out or customer recovery
BitMart's statement and Bitquery's labels	A lead for cross-incident investigation	A confirmed common exploit or supplier

The Bitcoin snapshot contains no outgoing collector spend, and does not show a mixer hop or exchange cash-out from that address. This does not account for every asset on every affected chain. Recovery status still requires separate evidence from the exchange and its customers.

Before sending more funds

Use a known bookmark or type the official exchange address. Mercado Bitcoin's November 4 notice says account checks and resets belong inside its own site or app and warns against requests for credentials or deposits through messages.

Confirm that deposits have reopened and verify the current receiving instructions inside the account before sending. An old saved address is not evidence that the service is ready to receive funds. If you later withdraw to self-custody, prepare the receiving wallet and its offline signing and backups first. An exchange balance and a wallet you control have different custody risks. Our guide to connecting a wallet explains the wallet's role.