Mercado Bitcoin Suspends Transfers After More Than $40 Million in Suspected Outflows

Mercado Bitcoin halts deposits and withdrawals

Mercado Bitcoin, the Brazilian cryptocurrency exchange, suspended both deposits and withdrawals on Monday after security firm Hypernative reported more than $40 million had left wallets it associated with the platform overnight. The exchange said it had identified and quickly contained a security incident in one of its systems early that morning. The pause restricts transfers into and out of the service while the company investigates.

The exchange said customers had suffered no losses and that no customer data had leaked. It also said its teams were investigating, tracking the assets and coordinating measures with the competent authorities. Those assurances describe the company’s stated assessment, rather than a conclusion about how the incident occurred: the information supplied so far does not identify the system affected or explain how the transfers were authorized.

Hypernative described its dollar figure as preliminary because it still needed to confirm that every source address belonged to Mercado Bitcoin. That qualification matters: the reported amount is a security firm’s estimate based on wallet activity, not a final exchange accounting in the supplied information. The company’s service suspension is confirmed, but the eventual total and the full scope of affected wallets remain to be established.

Cross-chain transfers and unresolved signing questions

Hypernative said the transfers crossed at least 10 blockchains, naming Bitcoin, Ethereum, Solana and Tron among them. The first suspicious movement it identified was at 2:15 UTC. The broad chain coverage points to activity involving multiple networks, but the source does not detail the amounts sent on each chain or provide a complete breakdown of all the transactions included in the preliminary estimate.

The largest transfers occurred from 6:19 to 6:53 UTC, when wallets linked to Mercado Bitcoin sent most of the funds to newly created addresses, according to Hypernative. The firm said these were ordinary signed transactions, meaning they appeared on-chain as if the source wallets had authorized them. It has not established how an attacker obtained the ability to sign transactions from those wallets.

Mercado Bitcoin later published five destination addresses it connected to the incident, spanning EVM networks, Bitcoin, Solana, Stellar and Tron. The set of published addresses gives observers specific destinations to monitor, but it does not by itself resolve ownership of every source wallet or explain the route by which signing authority was obtained. Hypernative’s preliminary attribution remains an important limitation on the reported total.

Tracing the destination wallets

Bitcoin explorer mempool.space showed that the published Bitcoin address received about 106 BTC early on Monday. Most arrived in one transfer: 104.4 BTC at 6:41 UTC. The supplied report said none of that Bitcoin had moved by 14:50 UTC. That snapshot indicates the funds remained at the address at that time, but it does not establish whether they were recoverable or what happened to them afterward.

Tether froze USDT sent to two of the destination addresses, with on-chain data showing the relevant USDT contracts on Ethereum and Tron listed as blacklisted. The Tron address held 708,243 USDT, while the Ethereum address held more than 3 million. The reported freezes apply to those stablecoin balances; the source does not say that other assets or addresses were frozen.

The on-chain details show distinct outcomes among the traced assets: the Bitcoin balance was reported unmoved at the stated observation time, while USDT at two addresses was frozen by Tether. These facts document monitoring and intervention, but do not establish that all of the reported outflows were contained. The source gives no final recovery figure, and it remains unclear how much of the preliminary total may be returned or otherwise immobilized.

A separate incident at Binance adds security context

The Mercado Bitcoin incident followed a separate Binance loss that the report places four days earlier, on October 29. Binance lost $6.3 billion from its hot wallets, and Hypernative called that event the largest crypto theft on record. The close sequence of incidents supplies context about exchange security, but the source does not connect the two cases or suggest that they shared an attacker or technical cause.

Binance attributed its loss to a compromised DevOps engineer’s laptop, which it said enabled an attacker to submit unauthorized withdrawals. The exchange also halted withdrawals while it overhauled the security of its withdrawal service. This account concerns Binance, not Mercado Bitcoin: Hypernative has not yet explained how the Mercado Bitcoin transactions acquired signing authority, so the mechanism in one incident cannot be assumed to apply to the other.

About $3 billion of the Binance funds was frozen on-chain with help from blockchain partners, according to the report. That response is a separate example of funds being immobilized through cooperation, not evidence of an equivalent recovery in the Mercado Bitcoin case. For Mercado Bitcoin, the known points are the withdrawal suspension, the exchange’s assurances about customers, the address-level activity and the USDT freezes; the cause, final loss and recovery remain unresolved.

Source: CryptoPotato