Mercado Bitcoin losses top $46M as funds keep moving after hack

What happened

Mercado Bitcoin, one of Brazil's largest crypto exchanges, suspended deposits and withdrawals on Monday after a security breach drained more than $46 million in cryptocurrency from its wallets. The company said customer funds and data were safe and described the halt as a precautionary measure while it investigates the incident alongside "competent authorities."

The movement did not stop when the announcement was made. According to Cointelegraph, addresses connected to the breach continued to receive funds for hours afterward, followed by thousands of small Ether transfers consolidated into a single address. Arkham analyst Emmett Gallic said the losses exceeded $46 million and were still climbing, describing old deposit addresses being swept while the attacker sold off memecoins and altcoins.

CertiK senior security engineer Dickson Wu published an initial post-mortem stating that the attackers "picked at eight small chains for four hours," naming Base, Optimism and Arbitrum among them, before moving against the exchange's main hot wallets and sending tiny amounts of ETH from 27,160 separate addresses. Wu noted that whoever carried out the attack could therefore also move money out of Mercado Bitcoin's customer deposit addresses. Security firms said the theft relied on standard transfers rather than a smart contract exploit. A Mercado Bitcoin spokesperson told Cointelegraph that customers had suffered no losses and no data had leaked, but the company did not answer questions about the continued transfers.

Why it matters

The episode puts a spotlight on how exchanges manage the large pools of deposit addresses that customers have used over time. If those addresses can be swept after an incident is declared contained, the practical exposure may extend beyond a single hot wallet. It also creates a disclosure question: Cointelegraph noted that a data breach could trigger notification obligations to Brazil's data protection authority. The timing adds pressure, coming days after Binance disclosed a multibillion-dollar hack, and it lands on a platform that has positioned itself at the center of Brazil's tokenization and payments market with backing from stablecoin issuer Tether.

What the data shows

Reported figures sketch the scale of the incident. More than $46 million was drained initially, a number Arkham's Gallic said was growing. By 16:42 UTC, roughly $6.2 million had been frozen by stablecoin issuers Tether and Circle. About $20 million had been sent to newly created wallets, while more than $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC held in them. The attack touched eight smaller chains over four hours and generated 27,160 small ETH transfers, per CertiK's account. Mercado Bitcoin reported 4.5 million users as of July.

Background

Mercado Bitcoin has been among the most visible crypto firms in Latin America, and in July Tether announced a $20 million investment aimed at supporting its expansion into tokenization, payments and credit. The region has already seen disruption this year: Chile's Orionx, also Tether-backed, said in September it would close after a forensic audit found more than $7 million in customer assets had moved to wallets outside its control. The Mercado Bitcoin breach follows a much larger incident at Binance, which Protos reported at over $6 billion and which surpassed the roughly $1.5 billion Bybit heist. Binance has since reopened deposits and withdrawals, saying it had replenished 95% of stolen assets, while the US Secret Service is investigating and the FBI has asked node operators, including those run by THORChain, to block related transactions.

What is still unclear

Several points remain unresolved. The hack has not been attributed to any organized group and is still under investigation, and there has been no public confirmation of how the attacker retained access to deposit addresses after the exchange said the incident was contained. Mercado Bitcoin's assurance that customers lost nothing has not been independently verified, and it is not yet established whether any personal data was exposed. The final tally of losses, and how much of it can be recovered or frozen, is also open.

What to watch

The next signals will come from the investigation with Brazilian authorities and from any further freezes by stablecoin issuers or exchanges handling the funds. Also worth tracking is whether Mercado Bitcoin restores deposits and withdrawals, whether it revises its account of customer impact, and whether Brazil's data protection authority becomes involved. The precedent set by Binance's rapid replenishment of customer assets will shape how users judge the response.

Questions readers ask