Mercado Bitcoin Puts Security Incident at About $38 Million, Says Users’ Funds Are Safe

Mercado Bitcoin revises the reported scale of the incident

Mercado Bitcoin has put the value of assets involved in its security incident at about $38 million, while assuring customers they will not lose funds. The event led the Brazilian exchange to suspend deposits and withdrawals on Monday. Its public update frames the service halt as a protective step, not a statement that customer balances had been lost. The exchange has not said in the supplied account that every asset has been recovered; instead, it describes containment and recovery work as continuing.

The exchange’s figure is lower than the initial scale reported by blockchain security firm Hypernative, which said more than $40 million had moved from wallets tied to Mercado Bitcoin overnight. These numbers describe different updates: Hypernative gave a preliminary estimate of observed outflows, while the exchange later valued the assets involved at around $38 million. The source does not explain the difference or establish that the estimates cover precisely the same transfers, so they should not be treated as directly interchangeable.

Hypernative’s preliminary assessment covered transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. That breadth makes the incident more than a report of activity on a single network, but it does not by itself reveal how the wallets were accessed or who was responsible. The exchange’s stated figure and Hypernative’s larger initial estimate therefore supply a measure of scale, not a complete account of what happened or the status of every affected asset.

Suspended services followed suspicious wallet transfers

Mercado Bitcoin said it identified an incident in one of its systems during the early hours of Monday and temporarily suspended access to services as a preventive measure to protect customer assets. Deposits and withdrawals were halted while the company worked to establish what it described as full security conditions. This response limited access to normal exchange functions, but the source provides no reopening time. The exchange’s position is that services would resume only once the required security conditions were in place.

The first suspicious transfer was recorded at 2:15 UTC, according to the account of the incident. The largest movements followed between 6:19 and 6:53 UTC, when wallets linked to Mercado Bitcoin sent funds to newly created addresses. The timeline establishes a gap between the first recorded suspicious transaction and the heaviest reported transfer period. It does not establish when the underlying access or authorization problem began, or how long the relevant wallets may have been exposed.

The transfers appeared to be ordinary signed transactions, meaning they were sent as if the source wallets had authorized them. Hypernative said it remained unclear how an attacker obtained the ability to sign the transactions. That uncertainty matters because the visible on-chain activity does not, in the source, identify the method used to gain signing authority. There is no confirmed explanation here of whether credentials, systems or another part of the signing process were compromised, so any precise account of the breach would go beyond the evidence provided.

Blocking and recovery efforts remain in progress

Mercado Bitcoin says it had already blocked $11 million in coordination with Tether, Circle, Paxos, BRL1 and Chainalysis. The exchange also reported identifying other amounts eligible for blocking, with containment work still underway. The blocked sum is a stated part of the response, not evidence that the full reported $38 million has been recovered. Nor does the account specify how much the newly identified amounts represent, which assets they involve, or whether additional blocks have since been completed.

Cooperation with issuers and other named partners is central to the response described by the exchange: the reported blocks were achieved in coordination with them, while Chainalysis is also listed among the partners. The practical significance is that some assets identified in the incident could be targeted for blocking rather than simply tracked. But the source gives no breakdown by partner or token and does not say what further action each party can take. The results of ongoing efforts therefore remain open.

The exchange had previously said that no customer data had leaked. That statement addresses a separate concern from the movement of assets: the reported transfer activity does not, on its own, establish that customer information was exposed. The source does not describe the scope of any investigation into data access, nor does it provide new technical findings on that question. For now, the report supports only the exchange’s earlier assurance about data and its current assurance that customers will not lose funds.

The transfer mechanism and wider context are still uncertain

The immediate operational consequence was a suspension of deposits and withdrawals, with a return to service tied to full security conditions rather than a stated deadline. Customers therefore faced interrupted access to those functions while the exchange addressed the incident. Mercado Bitcoin’s assurance about losses is important, but the source does not detail how it would cover any shortfall if recovery efforts failed, or explain the precise basis for its confidence. Those points remain unresolved in the information provided.

The report places the breach amid other security concerns, including a separately reported $6.3 billion Binance hack and a suspected theft flagged by blockchain investigator ZachXBT. That other case is described as involving more than $133 million in withdrawals from centralized exchanges linked to an unnamed EU entity. These are distinct incidents, and the source does not connect them to Mercado Bitcoin. Their inclusion supplies industry context, not evidence of a shared attacker, method or cause.

For Mercado Bitcoin, the key unanswered questions are how signing authority was obtained, whether further assets can be blocked, and when deposits and withdrawals can safely resume. The exchange has provided an approximate incident value, cited $11 million in blocks and said containment continues, but the source offers no final recovery total or technical explanation. Until those details are available, the scale and response can be described from current statements, while the breach’s mechanism and ultimate outcome remain uncertain.

Source: CryptoPotato