Mercado Bitcoin Halts Withdrawals After $40 Million Drained Across 10 Blockchains

Mercado Bitcoin, Brazil's largest crypto exchange, suspended deposits and withdrawals on Monday, November 2, after a security incident in one of its systems. The exchange announced the incident in a statement on X at 12:56 UTC. "We identified and quickly contained a security incident in one of our systems overnight," the statement said. "There was no loss to clients; there was no data leak."

What the exchange says

The exchange said its teams are investigating the incident, tracing the assets and coordinating with authorities. It has not given a loss figure of its own. It has not called the incident a hack, and it has not said whose funds moved. About 90 minutes after its first statement, the exchange published the destination addresses it had identified in movements tied to the incident, on EVM networks, Bitcoin, Solana, Stellar and Tron. It said the addresses were shared only so they could be identified and tracked.

The 40 million dollar estimate

The figure in the headlines comes from Hypernative, a blockchain security firm. Hypernative estimated that more than $40 million was drained from wallets it attributes to Mercado Bitcoin. The exchange has not confirmed that estimate. The outflows hit wallets across at least 10 blockchains. Hypernative named nine of them: Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. By Hypernative's count, the attacker holds about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens, in fresh addresses.

How the money moved

Most of the money moved in a 34 minute window from 06:19 to 06:53 UTC on November 2. Sweeps of the exchange's bitcoin deposit addresses to the same attacker had begun earlier, at 02:15 UTC. The transfers were plain transactions, not a smart contract exploit, and how the attacker obtained signing access is still unknown. The Bitcoin address the exchange named had received about 106.07 BTC across seven transactions. Of that total, 104.43 BTC arrived in a single transfer timestamped 06:41 UTC, according to a review of the address on the Blockstream block explorer. None of the bitcoin had left the address at the time of that review.

Some funds frozen, no attribution yet

Tether founder Paolo Ardoino confirmed that $4.5 million worth of USDT linked to the incident has been frozen. No attribution has been made. There is no public evidence linking this incident to the Binance hack of October 29, in which about $6.3 billion was stolen and which the FBI attributed to North Korea's TraderTraitor group, CoinDesk reported. For customers, the immediate question is when deposits and withdrawals will resume. The exchange has not given a time for that in the statements reported so far.