Brazil's Mercado Bitcoin halts withdrawals after $40 million drain

Updated 2 November, 14:52 UTC. Mercado Bitcoin has published the destination addresses of the transfers, confirming the ones Hypernative flagged.

Mercado Bitcoin, Brazil's largest cryptocurrency exchange, said on Monday that it had identified and contained a security incident in one of its systems overnight and suspended deposits and withdrawals as a precaution. The exchange said customers suffered no losses and no data leaked, and that its teams are tracing the assets with the authorities.

At 14:24 UTC the exchange published the destination addresses of the transfers tied to the incident, on Ethereum and other EVM chains, Bitcoin, Solana, Stellar and Tron, so that others can trace the assets. They are the addresses blockchain security firm Hypernative had already flagged.

Hypernative has also put a figure on it. Its alert, reported by BitNotícias with the addresses and transactions behind it, counts more than $40 million in suspicious outflows from wallets attributed to the exchange, across at least ten blockchains. The Block carried the same figure alongside the exchange's confirmation. Mercado Bitcoin has not confirmed an amount.

The exchange, founded in São Paulo in 2013, has about 4.8 million clients, according to Crypto Briefing.

Timeline

According to Hypernative's data, suspicious activity from the exchange's deposit addresses began at 02:15 UTC, late on Sunday evening in Brasília. The largest transfers ran from 06:19 to 06:53 UTC. The public ledgers match that window: one transaction moved 2,852 ETH at 06:24 UTC, and another sent 104.4 BTC at 06:41 UTC, both to addresses Hypernative flagged. Mercado Bitcoin's statement followed at 12:56 UTC, and its list of addresses at 14:24 UTC.

What left the wallets

Hypernative's list of balances at the receiving addresses includes about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, 77,000 AVAX, 3.07 million XDC and 1.7 million TRX, plus more than 200 other tokens, on chains including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar.

At least one token issuer has confirmed its own loss. EverValue said about 28,200 EVA left the exchange's wallet for an address controlled by the attacker, and that Tether has frozen the USDT the attacker moved on Ethereum.

The funds are already moving on. The flagged Ethereum address forwarded 2,800 ETH to a new address at 12:07 UTC and has been sending out other tokens since.

What is not known

The transfers were ordinary signed transactions from the exchange's own addresses, not a smart contract exploit, BitNotícias notes. Whoever moved the funds could sign for the exchange's wallets on many chains at once; how the threat actor got that ability is the open question. Mercado Bitcoin has said only that the incident was in "one of our systems" and has not said whether keys or the system that signs withdrawals were compromised.

BitNotícias also cautions that the $40 million estimate assumes every source address belongs to the exchange. The exchange has not said when deposits and withdrawals will resume.

Addresses to watch

Mercado Bitcoin says it is sharing the addresses only for identification and tracing, and Hypernative recommends that exchanges, OTC desks and cross-chain bridges monitor them. The Ethereum and EVM address is 0xe485e7a70b1131216cb47ca4555c4bbb2c742478, the Bitcoin address 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp, the Solana address 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J, the Tron address TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L and the Stellar address GDXYRI6IONQA5YTGRLQ6O3FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP. Mercado Bitcoin has promised regular updates on its X account.