Mercado Bitcoin, one of Brazil’s largest crypto exchanges, has suspended deposits and withdrawals after what it called a security incident in one of its systems overnight. The company says customers lost nothing and no data leaked. Blockchain security firm Hypernative said at least $40 million in the exchange’s wallets was compromised, and the funds were moved on at least 10 blockchains.
The exchange has not given a figure of its own. In its official statement, published in Portuguese on Monday, it said it identified and quickly contained the incident, paused deposits and withdrawals as a preventive measure, and is investigating, tracing the assets and working with the relevant authorities. On Monday afternoon its support account was still telling customers that access to transactions remained suspended.
What the on-chain trail shows
Hypernative’s figure of at least $40 million, about R$217.7 million, was reported by Exame. CoinDesk added detail from a report relayed by Pablo Sabbatella, founder of security firm Opsek. According to that report, the biggest outflows came between 06:19 and 06:53 UTC, when wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, Stellar and other networks sent most of their funds to fresh addresses.
The same report put the attacker’s holdings at roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens. The transfers were ordinary signed transactions, not a smart contract exploit, and how the attacker got the ability to sign them is not known.
The exchange published the destination addresses
In an update a little under 90 minutes after its first statement, Mercado Bitcoin listed the addresses that received the funds on EVM networks, Bitcoin, Solana, Stellar and Tron, so that other platforms could monitor and trace them.
AltcoinReporter checked two of them. The Bitcoin address has received seven transactions totalling 106.07 BTC, about $8.2 million at current prices, and had spent none of it by the time of writing. The EVM address on Ethereum has been busier. It sent 2,930 ETH to one newly used wallet, 470 ETH to a second and 200 ETH to a third, about 3,600 ETH in all and more than the 2,852 ETH in the report CoinDesk cited earlier in the day. Roughly 50 ETH remained in the original address.
More than 20 ERC-20 tokens, among them AAVE, LINK, LDO, ONDO, SHIB and PEPE, were also moved out, at least in part, to other fresh addresses. Around 147,800 UNI were still sitting in the address. It has also started receiving dust from lookalike addresses that copy the first and last characters of the wallets it has been using, a standard address-poisoning trick that does not change the picture.
Valuing those five coins at current prices gives about $17 million, by our calculation. That suggests stablecoins and the long tail of smaller tokens make up much of the rest of the $40 million estimate, though the breakdown has not been published.
Tether freezes part of the haul
Some of the stablecoin portion is already stuck. “Tether froze more than 4.5M USDT related to this security incident,” Tether CEO Paolo Ardoino said, quoting the exchange’s statement. Exame, citing people involved in the investigation, put the frozen amount at about $3.7 million. Ardoino’s higher figure comes directly from the stablecoin issuer.
CoinDesk reported that nobody has claimed or been blamed for the attack, and that there is no public evidence tying it to last week’s Binance theft, which the FBI has attributed to North Korea’s TraderTraitor group. The timing has still put exchange hot wallets back in focus. Earlier on Monday, South Korea’s financial regulator pressed local exchanges to raise their cold wallet ratios because of the Binance incident.
A sensitive week for Brazilian licensing
The incident lands days after a regulatory milestone. Exame noted that Mercado Bitcoin recently applied to Brazil’s central bank for authorisation as a virtual asset service provider under rules published late last year. The deadline for existing firms to apply was Friday, October 30, and the central bank now has more than 60 applications to review.
Security and custody controls are central to that process, so how Mercado Bitcoin explains the incident, and how quickly it restores withdrawals, will be watched by customers and supervisors alike. When Exame tried to log in to the app on Monday, the login failed.
The open questions are the ones that matter most for users: what system was compromised, whether the drained wallets were exchange hot wallets or customer deposit addresses, and when the platform will reopen. The company has said it will post updates on its official channels.
FAQ
Did Mercado Bitcoin customers lose money?
The exchange says no customers suffered losses and no data leaked. It has not said how much left its wallets or who will absorb the loss.
How much was taken?
Hypernative puts the compromised amount at a minimum of $40 million, and CoinDesk reported wallets drained on at least 10 blockchains. Mercado Bitcoin has not confirmed an amount, and Tether says it has frozen more than 4.5 million USDT linked to the incident.
When will withdrawals resume?
No date has been given. Deposits, withdrawals and app access remained suspended at the time of writing, and the exchange said updates would come through its official channels.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
