Brazil's Mercado Bitcoin halts withdrawals after $40 million drained from its wallets

Mercado Bitcoin, one of Brazil's largest crypto exchanges, suspended deposits and withdrawals on Monday, 2 November, after wallets linked to the platform were drained across at least ten blockchains. On-chain trackers put the outflows at more than $40 million. The exchange has not confirmed any amount. It says the incident was "identified and swiftly contained" and that customers lost nothing, CoinDesk reported. It is the second large exchange breach in a week, after Binance.

How the wallets were drained

Most of the money left between 06:19 and 06:53 UTC, or 03:19 to 03:53 in São Paulo. Wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, Stellar and other networks sent their balances to freshly created addresses. According to figures relayed by Pablo Sabbatella, founder of the security firm Opsek, the attacker ended up with about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, 77,000 AVAX and more than 200 other tokens. The blockchain security firm Hypernative was among the first to flag the transfers.

These were ordinary transfers, not an exploit of a smart contract. Whoever sent them had the ability to sign transactions from the exchange's wallets, and how they got it is still unknown. Nobody has claimed the attack, and there is no public evidence linking it to Binance, where the FBI blamed the North Korean group TraderTraitor.

What the exchange says

In a post on X, Mercado Bitcoin wrote that it had found and contained a security incident "in one of our systems" overnight. "There was no loss to customers," the company said, and no customer data leaked. Deposits and withdrawals were paused as a precaution, and access to the app was also temporarily suspended, Money Times reported. The company says its teams are tracing the assets and working with the authorities, without naming them. It later published the attacker's destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron so that other platforms can block them. No date for reopening has been given.

Tether CEO Paolo Ardoino said the company "froze more than 4.5M USDT related to this security incident", crypto.news reported. That covers only a small part of the losses: ether, bitcoin and most other coins cannot be frozen by an issuer. Tether also has a stake in the outcome: in July it invested $20 million in Mercado Bitcoin. Founded in São Paulo in 2013, the exchange has more than 4.8 million clients, according to Crypto Briefing. In August, Brazil's central bank announced a real-time crypto threat alert system built with Hypernative, and Mercado Bitcoin was named as one of the planned participants. The exchange has not said whether that system helped this time.

What Mercado Bitcoin users should do

• Follow news only on the exchange's official website and verified accounts. Access to the app was suspended, so any "app update" or "new app" sent to you in a message should raise suspicion.
• Ignore offers of "refunds", "compensation" or "account verification". After big hacks, phishing that uses the news always follows, and no real refund asks for your password, a 2FA code or a seed phrase.
• When the app returns, check your balance and transaction history, and make sure two-factor authentication and the withdrawal address whitelist are on.
• Do not rush to move everything at once on the first day: queues and delays are likely after a restart, and fake "support" accounts tend to show up at such moments.

This is the third exchange hack in two weeks, after India's CoinDCX, which first denied and then admitted a $16 million loss, and Binance with $6.3 billion. While coins sit on an exchange, the exchange holds the keys, and its outage or hack becomes your problem too. For long-term savings, a hardware wallet that you control is the safer option.