Mercado Bitcoin, recognized as one of Brazil’s largest cryptocurrency exchanges, reported a security breach resulting in over $46 million siphoned from its wallets on Monday. Despite the company’s immediate suspension of deposits and withdrawals, cryptocurrency addresses linked to the incident continued to process transactions for several hours following the announcement.
Details of the Attack
Cybersecurity firms indicated the perpetrators conducted the theft through conventional transfers rather than exploiting vulnerabilities in smart contracts. Analysts identified that the attackers methodically targeted eight less prominent blockchains, including Base, Optimism, and Arbitrum, over a four-hour window before moving on to Mercado Bitcoin’s main hot wallets.
Dickson Wu, senior security engineer at Certik, detailed in his post-incident analysis that the attackers extracted small amounts of Ether (ETH) from 27,160 different addresses, further complicating the trail of stolen funds. Wu emphasized the attackers’ capacity to move assets directly from customer deposit addresses linked to Mercado Bitcoin.
So whoever did this can also move money out of MB’s customer deposit addresses, highlighting a broader vulnerability within Mercado Bitcoin’s infrastructure, according to Certik’s Dickson Wu.
Following the company’s disclosure and operational suspension, digital assets continued to flow out of compromised addresses, and thousands of minor ETH transfers ultimately converged into a single account.
Mini dictionary: Certik is a blockchain security firm specializing in auditing smart contracts and investigating crypto-related security incidents.
Response and Investigation
A Mercado Bitcoin spokesperson stated that customers had not incurred financial losses and that personal data remained secure. However, the company did not address the ongoing asset transfers after the public announcement. If customer data were to be compromised, current Brazilian regulations would require Mercado Bitcoin to alert the national data protection authority.
The entity or individuals responsible for the breach have not been identified, and investigations into the hack are ongoing.
Asset Recovery Efforts
According to available data at 4:42 pm UTC, stablecoin issuers Tether and Circle successfully froze approximately $6.2 million associated with the attack. Meanwhile, $20 million had already been moved to new crypto wallets, and roughly $20 million—including all 106 BTC connected to the incident—remained in addresses traced by Mercado Bitcoin.
| Asset Status | Amount |
|---|---|
| Frozen by stablecoin issuers | $6.2 million |
| Moved to new wallets | $20 million |
| Still in identified addresses | Over $20 million (including 106 BTC) |
As of July, Mercado Bitcoin reported a user base of 4.5 million. That same month, Tether, a leading stablecoin issuer, invested $20 million in the exchange to promote expansion into tokenization, payments, and credit services within Brazil’s growing digital asset market.
Chile-based Orionx, another Tether-supported cryptocurrency exchange in Latin America, ceased operations in September after forensic auditors discovered over $7 million of customer funds had been transferred to uncontrolled wallets.
This recent breach at Mercado Bitcoin follows another high-profile incident, as Binance, a global cryptocurrency platform, experienced a $6.3 billion theft targeting its hot wallets days earlier. Binance implemented a temporary suspension of deposits and withdrawals and later resumed withdrawals, reporting that it had restored 95% of the stolen assets.
