Mercado Bitcoin (MB) suspended deposits and withdrawals on Monday after more than $40 million left wallets tied to the Brazilian exchange overnight, according to security firm Hypernative.
The exchange confirmed the incident in a statement on X, saying it had identified and quickly contained a security incident in one of its systems early that morning. MB said customers suffered no losses and no customer data leaked.
“Our teams are mobilized investigating the case, tracking the assets and coordinating measures with the competent authorities,” the company said.
Flows Across 10 Chains
Hypernative said the transfers ran across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. The first suspicious transfer came at 2:15 UTC. The largest transfers came between 6:19 and 6:53 UTC, when wallets tied to MB sent most of the funds to newly created addresses.
Those transfers were ordinary signed transactions, sent as if the source wallets had authorized them. Hypernative said it is not yet clear how the attacker got the power to sign those transactions. The firm called its estimate preliminary, since it still has to confirm that every source address belongs to MB.
MB later published five destination addresses linked to the incident, on EVM networks, Bitcoin, Solana, Stellar and Tron. The Bitcoin address took in about 106 BTC early on Monday, data from blockchain explorer mempool.space shows. Most of that Bitcoin arrived in one transfer of 104.4 BTC at 6:41 UTC.
Tether has frozen the USDT sent to two of those addresses. Its USDT contracts on Ethereum and Tron are both listed as blacklisted, according to on-chain data. The Tron address holds 708,243 USDT, and the Ethereum address holds more than 3 million.
Breach Follows Binance’s $6.3B Loss
The MB breach came four days after Binance lost $6.3 billion from its hot wallets on October 29. Hypernative called the Binance loss the largest crypto theft on record. Binance traced the theft to a compromised DevOps engineer’s laptop, which let an attacker submit unauthorized withdrawals.
Binance also halted withdrawals while it overhauled the security of its withdrawal service. About $3 billion of the stolen Binance funds was frozen on-chain with help from blockchain partners.
