Mercado Bitcoin Suspends Services After $38M-$45M Hack, Estimates Vary
Brazilian exchange Mercado Bitcoin suspended deposits and withdrawals after an attack that moved funds from wallets across at least 10 blockchains. Reported losses range from $38 million to $45 million, with $11 million blocked so far and the company saying customers will not lose assets.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Scale of the Losses
Brazil's Mercado Bitcoin put the value of assets involved in its security incident at about $38 million, and said $11 million had been blocked with help from Tether, Circle, Paxos, BRL1 and Chainalysis. Other outlets report a larger figure. ZyCrypto cited initial research placing losses at $40 million, plus an additional $5 million reported by Arkham Intelligence analyst Emmett Gallic, bringing the total to $45 million. Blockchain security firm Hypernative's preliminary estimate was more than $40 million moved out of exchange-linked wallets overnight. The gap between the $38 million company figure and the $45 million analyst figure has not been reconciled in the sources, and the exchange has said that additional eligible amounts have been identified and containment is ongoing.
How the Transfers Were Made
Hypernative reported that the first suspicious transfer occurred at 2:15 UTC, with the largest movements between 6:19 and 6:53 UTC, when wallets tied to the exchange sent funds to newly created addresses. The transactions were ordinary signed transfers, meaning they were authorized as if the source wallets had approved them. Hypernative said it remains unclear how the attacker obtained the ability to sign them. ZyCrypto added that the attacker appeared to target older deposit addresses and was selling off memecoins and altcoins, and that the exchange has not confirmed the attack method.
Company Response
Mercado Bitcoin temporarily suspended deposits and withdrawals as a preventive measure and said services would resume once full security conditions were in place. The company stated that no customer data had leaked and that users would not lose assets. It later published destination addresses to support community tracking efforts.
Broader Context
The incident follows a string of large exchange breaches. ZyCrypto reported it came within 30 days of other attacks, and noted that Binance faced a breach involving roughly $6 billion in assets, of which a large portion was traced, while Bybit lost nearly $1.5 billion earlier. The FBI and other agencies have attributed the Bybit and related incidents to North Korean hackers, according to ZyCrypto. CryptoPotato, however, reported that blockchain investigator ZachXBT separately flagged a suspected theft of more than $133 million from centralized exchanges linked to an unnamed EU entity, and said he was highly confident that activity was not linked to North Korea's Lazarus Group. ZachXBT's account is separate from the Mercado incident, and the sources do not establish a direct link between the two.
What Remains Open
The attack vector, the final loss figure and the identity of the attacker remain unconfirmed in the reporting. Commentators cited in ZyCrypto warned that repeated hacks on major platforms weigh on broader market confidence, and users pointed to AI-assisted attack tools and concerns about quantum computing. Mercado Bitcoin's timeline for restoring full service has not been specified.
Why It Matters
For Traders
Holders with funds on Mercado Bitcoin should watch for the service restoration timeline, since deposits and withdrawals remain suspended and the final loss figure is still unsettled.
For Investors
A cluster of major exchange breaches over a short span raises questions about custody security across centralized platforms, which could affect long-term confidence in exchange-held assets.
For Builders
Signed-transaction attacks that bypass normal authorization controls point to a need to audit wallet signing infrastructure and key management, not only smart contract code.
This article is for information only and is not financial advice. Read the full disclaimer.
