Mercado Bitcoin Halts Withdrawals Over Security Incident as Hypernative Flags $40 Million Drain

Brazilian crypto exchange Mercado Bitcoin suspended deposits and withdrawals on Monday after what it called a security incident in one of its systems. Blockchain security firm Hypernative estimated that more than $40 million was drained from wallets it attributes to the exchange.

In an official statement on X at 12:56 UTC, Mercado Bitcoin said it had identified and quickly contained the incident overnight. The exchange wrote in Portuguese that there were no losses to clients and that no data had leaked. Its teams were investigating, tracing the assets and coordinating with the authorities, it said. The exchange has not given a loss figure, has not called the incident a hack and has not said whose funds moved.

90 minutes later, Mercado Bitcoin posted the destination addresses it had identified in movements tied to the incident, on EVM networks, Bitcoin, Solana, Stellar and Tron. It said the addresses were shared only so they could be identified and tracked.

Get Unchained's crypto news in your inbox with the free Unchained Daily .

What the Bitcoin Address Holds

The Bitcoin address the exchange named had received 106.07 BTC across seven transactions, according to an Unchained review of the address on the Blockstream block explorer at 14:58 UTC. The first transfer landed in a block timestamped 05:42 UTC, and 104.43 BTC of the total arrived in a single transfer timestamped 06:41 UTC. None of the bitcoin had left the address at the time of the review.

In an alert shared by Opsek founder Pablo Sabbatella, Hypernative described the outflows as "plain transfers, not a smart contract exploit," and said it was still unclear how the attacker got signing access. By its count, the attacker now holds 2,852 ETH , 106 BTC, 10,700 SOL and 6.7 million XLM, plus more than 200 other tokens, in fresh addresses on at least 10 chains. It named nine: Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar.

The firm said most of the money moved in a 34-minute window, from 06:19 to 06:53 UTC, but that sweeps of the exchange's bitcoin deposit addresses to the same attacker had begun earlier, at 02:15 UTC. Mercado Bitcoin has not confirmed any of Hypernative's figures.

The incident came four days after billions of dollars drained from Binance's hot wallets on Oct. 29. Neither Mercado Bitcoin nor Hypernative has tied the two events together.

In its second post, Mercado Bitcoin said it was working to restore operations safely and would keep clients informed through its official channels.

Related Listen: Can THORChain Stay Neutral After the $388M Bitget Hack?