Blockchain forensics from Bitquery have identified that the perpetrator behind the November 2, 2026, Mercado Bitcoin hack is the same entity responsible for a simultaneous $391,000 theft from BitMart. While Mercado Bitcoin initially informed the public that the security threat was contained shortly after detection, report data shows that unauthorized outbound transactions persisted for several hours beyond that statement. This overlap suggests a sophisticated cross-platform campaign rather than an isolated incident.
The founder of BitMart has since confirmed the breach, noting that the stolen $391,000 was primarily moved from wallets that Bitquery has now tied to the Mercado Bitcoin attacker. The speed and precision of the movement across these two platforms indicate either a shared vulnerability in a third-party service or a highly coordinated exploit of exchange-side withdrawal protocols. For US-based users who interact with international liquidity providers, this highlights the ongoing risks of centralized points of failure in the global exchange ecosystem.
From a regulatory standpoint, these events are likely to draw the attention of the SEC and the CFTC regarding how exchanges disclose active threats to their users. In 2026, the 'contained' status of a hack is no longer just a technical milestone but a legal representation that can impact liability. If an exchange prematurely claims an attack is over while funds are still being drained, they may face heightened scrutiny under consumer protection laws.
Market participants should watch for further updates from Bitquery and official security post-mortems from both exchanges to determine if more platforms were affected. Currently, the industry is looking for a signature or 'footprint' of the attacker to see if this represents a new trend in multi-exchange exploits. Investors are advised to monitor their own exchange-based holdings and prioritize hardware wallet storage until the full scope of this 2026 vulnerability is understood.