Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, confirmed a security incident on Monday after attackers draine millions of dollars from its hot wallets across at least 10 blockchains, forcing the platform to suspend deposits and withdrawals.
Why it matters: Mercado Bitcoin serves about 4.5 million customers, and the breach is the second major exchange hack in less than a week, following the $6.3 billion Binance hack on October 29.
Mercado Bitcoin said it detected the problem in the early hours of Monday and triggered its security protocols, suspending access to services as a precaution to protect client assets. The exchange said customers will not suffer any loss of assets as a result of the incident and that it will absorb the loss itself.
Estimates of the total loss differ. Mercado Bitcoin put the figure at about $38 million in its own update. Security firm Hypernative estimated more than $40 million drained from wallets linked to the exchange, while Arkham Intelligence tracked about $46 million and Bitquery estimated about $48.5 million.
Working with Tether, Circle, Paxos, BRL1 and Chainalysis, the exchange said it has already blocked about $11 million of the stolen funds, with more funds identified that could still be blocked. Tether separately froze more than $9 million linked to the attack.
On-chain analysts said the stolen funds moved as plain transactions, not through a smart contract exploit, pointing to compromised signing keys for the exchange’s hot wallets. CertiK senior security engineer Dickson Wu said the attackers first picked at eight smaller chains for four hours, including Base, Optimism and Arbitrum, before moving to the company’s main hot wallets and sweeping small amounts of Ether from 27,160 different addresses.
Attacker holdings reported by on-chain analysts (Arkham / Opsek analysis; the exchange has not confirmed this breakdown).
| Asset | Reported amount moved |
|---|---|
| Bitcoin (BTC) | 106 BTC (about $8.16 million) |
| Ethereum (ETH) | 2,852 ETH (about $6.52 million in the first move) |
| Solana (SOL) | 10,700 SOL |
| Avalanche (AVAX) | 77,000 AVAX |
| Stellar (XLM) | 6.7 million XLM |
The attacker remained active after the breach. Arkham reported on November 3 that the hacker moved about $8 million in Ethereum to new wallets, including a single transfer of about 2,900 ETH worth $6.52 million. No deposit into Tornado Cash has been confirmed.
No group has been blamed for the Mercado Bitcoin breach, and there is no public evidence linking it to the Binance hack, which the FBI attributed to North Korea’s TraderTraitor group.
What is confirmed: the breach, the suspension of deposits and withdrawals, and the exchange’s pledge that customers will not lose funds. What is not confirmed: how the attackers got in, and when services will resume. Mercado Bitcoin said services will return only once security conditions are fully in place, and it has given no reopening date.
