Mercado Bitcoin, a major cryptocurrency exchange in Brazil, suspended all deposit and withdrawal operations on Monday after identifying a security incident within one of its systems. The exchange issued an official statement on X at 12:56 UTC, confirming that the issue had been contained overnight. While the company did not specify the exact nature of the breach, it emphasized that no client data had been compromised and that there were no direct losses to user funds. The exchange stated that its teams are currently investigating the matter, tracing the affected assets, and coordinating with relevant authorities to address the situation.

ETH / USD
Source: CoinGecko. Prices are indicative.

Hypernative estimates $40 million in outflows

Blockchain security firm Hypernative estimated that more than $40 million was drained from wallets attributed to the exchange. According to an alert shared by Opsek founder Pablo Sabbatella, the outflows consisted of direct transfers rather than a smart contract exploit. Hypernative noted that it remains unclear how the attacker obtained signing access to the wallets. The firm reported that the majority of the assets moved within a 34-minute window between 06:19 and 06:53 UTC, although sweeps of the exchange’s Bitcoin deposit addresses began earlier at 02:15 UTC. Mercado Bitcoin has not confirmed these specific figures or the total value of the incident.

Assets moved across multiple blockchains

Approximately 90 minutes after its initial statement, Mercado Bitcoin published the destination addresses associated with the incident on various EVM networks, Bitcoin, Solana, Stellar, and Tron. The exchange stated that these addresses were shared solely for identification and tracking purposes. Hypernative reported that the attacker now holds approximately 2,852 ETH, 106 BTC, 10,700 SOL, and 6.7 million XLM, along with more than 200 other tokens in fresh addresses across at least ten chains. The named networks include Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, and Stellar. An Unchained review of the specific Bitcoin address named by the exchange showed it received about 106.07 BTC across seven transactions, with the bulk arriving in a single transfer at 06:41 UTC.

Context and next steps

This incident occurred four days after billions of dollars were drained from Binance’s hot wallets on October 29. Neither Mercado Bitcoin nor Hypernative has linked the two events. In a follow-up post, Mercado Bitcoin indicated it is working to restore operations safely and will keep clients informed through official channels. The exchange has not labeled the event a hack, nor has it specified whose funds were moved, leaving the precise scope of the security failure under active investigation.