Brazil's Mercado Bitcoin froze deposits and withdrawals on Monday after wallets tied to the exchange were drained across at least 10 blockchains, with security firms estimating the loss at $40 million or more, CoinDesk reports.
What happened
The biggest outflows hit between 06:19 and 06:53 UTC, according to a report relayed by Pablo Sabbatella, founder of crypto‑security firm Opsek. In that 34‑minute window, wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other chains sent most of their funds to fresh addresses.
The attacker now holds roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens. The transfers were plain transactions, not a smart‑contract exploit, indicating the attacker had signing access rather than exploiting code. How that access was obtained remains unknown.
What the exchange says
In a statement on X, Mercado Bitcoin said it had "identified and swiftly contained" a security incident, that customers weren't harmed and that no data was breached. Deposits and withdrawals remain paused while the exchange investigates, tracks the assets and coordinates with authorities.
"We have identified and swiftly contained the incident, and no customer data was compromised." - Mercado Bitcoin on X
Context and timing
The incident occurs days after the $6.3 billion Binance hack, the largest crypto theft on record, which the FBI attributed to North Korea's TraderTraitor group. CoinDesk notes that no one has been blamed for the Mercado Bitcoin drain and there is no public evidence linking the two events.
While the exchange's statement emphasizes rapid containment, the report shows that the outflows were completed before the announcement. It is therefore unclear whether the "swift containment" refers to actions taken after the funds left the wallets or to measures that prevented further loss.
What to watch
- Fund movement: Monitoring whether the stolen assets are moved through mixers, exchanged for fiat, or frozen at off‑ramps.
- Investigation updates: Any clarification from Mercado Bitcoin on how the attacker obtained signing access could indicate whether the breach was due to insider compromise, phishing, or another vector.