✓ Verified by 5+ outlets BTC
Brazil's Mercado Bitcoin says it will cover all customer losses from a hot-wallet breach, as loss estimates range from $38 million to $46 million
🔴BearishA second major exchange losing tens of millions from its hot wallets days after the Binance hack adds to security worries, even though Mercado Bitcoin says it will cover customer losses.News sentiment, not financial advice. It reflects the likely impact of this news, not a price prediction.
Summary
Mercado Bitcoin, Brazil's largest crypto exchange, suspended deposits and withdrawals on Monday after what it called a security incident in one of its systems, saying it had contained it, that customers lost nothing and that no data leaked, CoinDesk, Decrypt and Bitcoin Magazine reported.
Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, though the exchange has not confirmed that figure, according to Decrypt and Bitcoin Magazine; Bitcoin Magazine said other analysts cite higher figures.
Tether CEO Paolo Ardoino said the stablecoin issuer froze more than 4.5 million USDT tied to the incident, all three outlets reported.
The exchange has not said how the attacker got in or when it will reopen, and CoinDesk and Decrypt said there is no public evidence linking it to last week's Binance hack.
Updates
- Update, : Update (Nov. 2, afternoon): Cointelegraph put the drain at over $46 million, above the roughly $40 million Hypernative flagged earlier, and reported that addresses tied to the breach kept moving funds for hours after the pause. CertiK engineer Dickson Wu said attackers probed eight small chains including Base, Optimism and Arbitrum for four hours before hitting the main hot wallets. By 4:42 pm UTC, Tether and Circle had frozen about $6.2 million, per Cointelegraph; the exchange still says customers lost nothing, and the attack has not been attributed.
- Update, : Update (Nov. 2, late afternoon): The Block also reported the breach at $46 million, saying Mercado Bitcoin confirmed the security incident earlier Monday and paused withdrawals, in line with Cointelegraph's figure.
- Update, : Update (Nov. 3, morning): Mercado Bitcoin said it will cover the losses and expects customers to lose nothing, CoinDesk reported. The exchange put the loss at around $38 million, below the $40 million-plus initially cited by researchers and the $46 million reported by The Block and Cointelegraph, and said $11 million has been frozen with help from Tether, Circle and Chainalysis. It said no customer data leaked.
- Update, : Update (Nov. 3, afternoon): Decrypt also reported the exchange's pledge to refund users and said withdrawals remain frozen with no restart date.
- Update, : Update (Nov. 4, evening): Mercado Bitcoin told Cointelegraph it will begin a phased reopening on Monday, first letting customers view balances, statements and holdings on its website, with transfers, withdrawals and trading returning in later phases after independent security testing. The exchange said it will use company funds to replenish affected assets, that more than $15 million in stolen funds has been frozen, and that its trading desk is preparing to buy back assets in domestic and international markets.
- Update, : Update (Nov. 5): Blockchain data firm Bitquery found the attacker kept draining Mercado Bitcoin customer deposit addresses for about four hours after the exchange said at 12:56 UTC on Nov. 2 that the breach was contained, emptying 36,042 Ethereum addresses between 12:27 and 16:56 UTC and tracing about $48.6 million across 10 chains, above earlier ~$40 million figures, CoinDesk reported. Bitquery also tied about $391,000 in earlier flows on Base, Arbitrum and Optimism to wallets it links to BitMart; BitMart founder Sheldon Xia said BitMart was hacked Nov. 2 and preliminarily suspects the same group.
- Update, : Update (Nov. 5, afternoon): Decrypt also reported forensic analysis tracing about $48.6 million across 11 blockchains and said thousands of customer deposit addresses were drained hours after Mercado Bitcoin said it had stopped the breach.
- Update, : Update (Nov. 9): Mercado Bitcoin began restoring read-only account access in phases on Monday, letting customers see their balances as of the Nov. 2 hack, but has not said when withdrawals will resume, Cointelegraph reported. Cointelegraph put the loss at an estimated $49 million.
- Update, : Update (Nov. 10): Mercado Bitcoin will resume Brazilian real deposits and withdrawals via Pix next week, only to accounts in the customer's own name, a company representative told Cointelegraph. Crypto deposits and withdrawals remain suspended with no return date.
Key facts
- A report relayed by Opsek founder Pablo Sabbatella said the biggest outflows hit between 06:19 and 06:53 UTC and that the attacker holds roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX plus more than 200 other tokens.
- The transfers were plain transactions rather than a smart contract exploit; how the attacker obtained signing access is unknown.
- Mercado Bitcoin published the destination addresses it identified on EVM chains, Bitcoin, Solana, Stellar and Tron so others can track the funds.
- According to Bloomberg, the company said it would absorb all losses.
- Tether invested $20 million in Mercado Bitcoin in July, when it said the exchange served 4.5 million users.
- The exchange said it will post regular updates on X and gave no date for resuming deposits and withdrawals.
- Mercado Bitcoin confirmed a security incident in which over $46 million in crypto was drained on Monday; addresses tied to the incident kept moving funds for hours after it paused deposits and withdrawals.
- As of 4:42 pm UTC, about $6.2 million had been frozen by Tether and Circle, about $20 million had moved to newly created wallets, and over $20 million, including all 106 BTC, remained in addresses Mercado Bitcoin identified.
- Cointelegraph: a spokesperson said read-only access would begin at 19:00 UTC on Nov. 9, with all accounts viewable by 21:00 UTC; customers must next confirm their registration details, and withdrawals will return via Pix, initially only to accounts in the customer's own name, with no date given.
- Cointelegraph: Mercado Bitcoin has yet to explain how the attackers gained access to its wallets.
Related stories
- Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
- Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor