Brazil’s largest crypto exchange, Mercado Bitcoin, halts withdrawals after suspected $40m hack

Brazil’s largest crypto exchange, Mercado Bitcoin, has suspended deposits and withdrawals after a security incident that analysts say drained more than $40 million. The exchange has since said that no customer lost money.

“We identified and swiftly contained a security incident in one of our systems early this morning,” Mercado Bitcoin said in a statement on X, translated from Portuguese. It said no customers were harmed and no data was breached.

The exchange called the suspension a precaution. Its teams are investigating, tracking the assets and coordinating with the authorities.

Who disclosed that over $40 million was taken from Mercado Bitcoin?

Blockchain security firm Hypernative has flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, according to a preliminary analysis reported by Decrypt. The exchange has not confirmed the figure. It has also not said which system was breached or how the attackers got in.

Also read: North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever

In a follow-up post, the exchange published destination addresses on five networks: Ethereum-compatible chains, Bitcoin, Solana, Stellar and Tron. It said the addresses were shared only to help others identify and track the funds.

Tether CEO Paolo Ardoino said in a post on X that the stablecoin issuer had frozen more than 4.5 million USDT linked to the incident. A freeze stops the tokens from moving. It does not return them to the owner.

Pablo Sabbatella, founder of security firm Opsek, relayed a report claiming that the biggest outflows came within about half an hour in the early hours of Monday. The report also claims the transfers were plain transactions, not a smart contract exploit. CoinDesk, which reported this, noted that how the attacker gained signing access is unknown. None of this has been independently verified.

A rough week for crypto exchanges

The attack comes days after hackers reached about $6.3 billion in assets at Binance, in what has been called the largest crypto hack on record. The FBI attributed it to North Korea’s TraderTraitor group.

Binance said attackers got in through an engineer’s laptop. It has since said it found additional points of breach. The exchange says it has replaced 95% of the affected assets and begun restoring withdrawals in phases.

Bitcoin Magazine reported that Tether froze about $1.57 billion in USDT and Circle froze more than $800 million in USDC in that case. There is no public evidence linking the exchange’s incident to the Binance attack, and Mercado has not named a suspect.

Read also: From PHP2Shell to Binance’s $6.3bn drain: inside the structural failures that caused Black October