Mercado Bitcoin, Brazil's largest cryptocurrency exchange, confirmed a cyberattack on Monday, November 2, and suspended all deposits and withdrawals after wallets linked to the platform were drained across at least 10 blockchains. Estimates of the loss range from more than $40 million (Hypernative and other security firms cited by CoinDesk and EthNews) to about $46.3 million (Arkham data cited by The Block), with The Record and Cointelegraph both reporting more than $46 million. The exchange has not confirmed a loss figure in its public statements. Bloomberg Línea reports that the company told it by text message that it would absorb a $40 million loss itself. Mercado Bitcoin says customers were not harmed and no data was leaked. Several blockchain security researchers dispute the first part of that claim. No one has been blamed for the attack.
What Happened
Blockchain analysts have pieced the timeline together from on-chain data. EthNews, citing BitNotícias and Hypernative's investigation, reports that the first suspicious activity appeared at about 02:15 UTC on Monday, involving Bitcoin deposit addresses attributed to the exchange. That was late Sunday night in Brazil, which matches The Record's account that funds began leaving "late on Sunday night." The largest outflows came between 06:19 and 06:53 UTC, according to a report relayed by Opsek founder Pablo Sabbatella to CoinDesk and repeated by EthNews. In that window, wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other chains sent most of their balances to fresh addresses.
CertiK senior security engineer Dickson Wu published an early post-mortem, reported by Cointelegraph, that describes the attack in stages. He says the attacker spent about four hours on eight smaller networks, including Base, Optimism and Arbitrum. The attacker then moved on to the exchange's main hot wallets, and after that sent small amounts of ETH from 27,160 separate addresses.
Mercado Bitcoin posted an official statement on X saying it had "identified and swiftly contained a security incident in one of our systems early this morning." It added that "our teams are mobilized, investigating the case, tracking the assets, and coordinating measures with the competent authorities." A second post said the company was working to "restore operations safely" and listed destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron so others could track the funds. Bloomberg Línea reports that the exchange also temporarily suspended access to its app. When G1 asked, the company would not confirm whether assets had been stolen or moved without authorisation. The Record says the company did not respond to its requests for comment.
Cointelegraph reports that addresses tied to the incident kept moving funds for hours after the exchange announced the suspension, followed by thousands of small ETH transfers to a single address. That raises questions about the company's statement that the incident was "swiftly contained." Mercado Bitcoin did not respond to Cointelegraph's questions about the continued transfers.
Recovery efforts have started. Tether CEO Paolo Ardoino said Tether froze about $4.5 million in USDT linked to the attacker, and The Record reports that other platforms froze another $2 million. Chainalysis says its investigators are tracing the coins so the industry can "identify, freeze, and disrupt impacted funds."
What Was Taken
This was a theft of cryptocurrency, not of data. Mercado Bitcoin says no customer data was exposed, and nothing published so far contradicts that. Cointelegraph notes that if customer data had been exposed, the company would have to notify Brazil's data protection authority (ANPD).
The report relayed by Sabbatella, which CoinDesk has not independently verified, says the attacker now holds about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens. An Arkham analyst quoted by The Block says the attacker was selling memecoins and other altcoins, which fits the usual pattern of converting less liquid tokens before freezes can catch up.
Accounts differ on whose money was taken. The company says customers suffered no losses. Bloomberg Línea reports that the attack targeted the exchange's hot wallets and that Mercado Bitcoin will cover the loss in full. However, The Record reports that several blockchain security experts posted on-chain evidence of funds being pulled from some customer wallets. The Arkham analyst says the attacker was sweeping funds from older deposit addresses, and Wu wrote that "whoever did this can also withdraw money from MB customers' deposit addresses." These positions can both be true: deposit addresses are controlled by the exchange, so funds can be taken from them while the company still makes customers whole from its own balance sheet. Mercado Bitcoin says it has about 4.5 million customers. It has not published a final count of affected assets or named the system that was compromised.
Why It Matters
The attack came days after the theft from Binance, reported at $6.3 billion by The Record and G1 and at more than $6 billion by CoinDesk and Bloomberg Línea. The FBI attributed that theft to North Korea's TraderTraitor group, the largest crypto theft on record. CoinDesk stresses that there is no public evidence linking the Mercado Bitcoin incident to Binance or to North Korea, and no one has claimed responsibility. The timing alone proves nothing. Even so, two major exchanges compromised within a week should push every custodian to review how its signing keys are protected.
The way the money was taken matters more for defenders than who took it. Security firms quoted by CoinDesk and Cointelegraph agree the drain used ordinary signed transfers, not a smart contract exploit. In other words, the attacker could sign transactions from wallets on more than 10 chains and from tens of thousands of deposit addresses. That points to a compromise of key management or signing infrastructure, not a bug in code. A breach at that layer bypasses most of the controls exchanges advertise.
Two more points stand out. First, the reported gap between the first suspicious activity at about 02:15 UTC and the main drain at 06:19 UTC was roughly four hours in which the attacker was on smaller chains before hitting the main hot wallets. Monitoring set up to alert on unusual outflows had time to catch it. Second, the dispute between the company's "no customer harm" message and the on-chain evidence shows that exchange statements are now checked against public blockchain data within hours. Statements that turn out to be wrong cost trust quickly.
The Attack Technique
How the attacker got signing access is not known, and neither Mercado Bitcoin nor any investigator has said publicly. Here is what has been observed:
- No smart contract exploit. CoinDesk and Cointelegraph report that the funds left through standard transfers signed with valid keys.
- Wide key access. The attacker moved funds on more than 10 chains (Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar, Base, Optimism and others), out of both main hot wallets and customer deposit addresses.
- Gradual escalation. According to Wu, the attacker spent about four hours on eight smaller networks before turning to the main hot wallets. That could have been testing, or a way to stay below alert thresholds.
- Bulk sweep. Wu says small amounts of ETH were sent from 27,160 different addresses and gathered into a single address, which suggests automated scripts with access to many deposit-address keys or to the system that derives them.
- Continued activity after the suspension. Cointelegraph reports outflows kept going after the company announced the pause, which suggests the attacker's access outlasted the first response.
The ability to sign from both hot wallets and thousands of deposit addresses fits a compromise of a central signing service, hot wallet infrastructure, or a master key used to generate deposit addresses. Investigators have not confirmed any of these possibilities.
What Organizations Should Do
- Keep deposit-address keys separate from hot wallet signing. If one system or one master key can sign for both, a single breach drains everything. Move deposit-address balances to cold storage often, so older addresses are not left holding funds.
- Alert on unusual outflows, with automatic pauses. Set alerts for transfers from many addresses at once, outflows to brand-new addresses, and unusual activity on smaller chains. A four-hour run-up on secondary networks should set off a freeze before the main wallets are hit.
- Require multiple approvals for signing. Use MPC or multisig with independent approvers and hardware-backed keys for hot wallets. Limit the amount any single key, service account or automated process can move per hour.
- Make "pause" actually stop the signing. Test that suspending withdrawals revokes signing access everywhere, including on smaller and secondary chains. Rotate keys and isolate signing hosts as part of the first response, not after it.
- Prepare freeze contacts before you need them. Keep current contacts at stablecoin issuers, major exchanges and blockchain analytics firms, and publish attacker addresses quickly. Tether's freeze of about $4.5 million here shows how much an early alert can save.
- Check public statements against the blockchain before posting. Claims about customer impact and containment will be tested against on-chain data within hours. Say what you know and what you don't, and update as the investigation goes on.
Sources: Largest crypto exchange in Brazil confirms cyberattack as ... | Mercado bitcoin hit by $40 million hack across 10 blockchains | Mercado Bitcoin sofre ataque dias após roubo bilionário na Binance G1 | Mercado Bitcoin sofre ataque hacker dias depois da Binance | Mercado Bitcoin, Brazil’s largest crypto exchange, hit by $46 milli... | Brazil's Mercado Bitcoin Hit by Breach as Questions Mount | Mercado Bitcoin sofre ataque hacker de US$ 40 mi, mas descarta perd... | Transferências do Mercado Bitcoin continuam após pausa nos saques