SECURITY ALERT

The statement said no customer lost anything.

The wallets said something had left.

Mercado Bitcoin, Brazil’s largest crypto exchange, has suspended deposits and withdrawals after wallets tied to it were drained across at least 10 blockchains early on Monday, with estimates of the loss running from about $40 million to $46.3 million, according to security firms cited by CoinDesk and Arkham data cited by The Block.

The exchange has not given a figure.

In its official statement, it said it had identified and quickly contained a security incident in one of its systems overnight, with no losses for customers and no data leak (our translation from Portuguese).

It says it is tracking the assets and coordinating with the authorities. The attack hit hot wallets, the internet-connected wallets an exchange uses for day-to-day transfers, and the exchange will absorb the loss, Bloomberg reported, according to O Globo.

What happened, in UTC

  • Mon 2 Nov, 06:19-06:53. The largest outflows leave its wallets on chains including Ethereum, Solana, Stellar, Tron, Avalanche, Polygon and Arbitrum, according to a report relayed by Opsek founder Pablo Sabbatella and cited by CoinDesk. Hypernative gave the same window, O Globo reported.
  • 12:56. Mercado Bitcoin confirms the incident and pauses deposits and withdrawals.
  • 14:24. It publishes the destination addresses so others can identify and track the funds.
  • 18:57. In a reply on X, it says access to all transactions on the platform is temporarily suspended.

CoinDesk reported that these were ordinary signed transfers rather than a smart-contract exploit. Nobody has explained how the attacker was able to sign them.

The addresses

EVM chains: 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478

Bitcoin: 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp

Solana: 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J

On mempool.space, the bitcoin address received about 106.07 BTC in seven transactions between 05:42 and 06:49 UTC, worth roughly $8.2 million at Kraken’s 20:46 UTC price. None of it had moved by 20:49 UTC.

That is our read of public data.

An Arkham analyst said the attacker was emptying old deposit addresses and dumping memecoins and other small tokens, The Block reported.

Frozen, not recovered

Tether chief executive Paolo Ardoino said more than 4.5 million USDT tied to the incident had been frozen by the issuer, according to The Block and CoinDesk. Exame put the frozen stablecoins at about $3.7 million, citing investigators.

Frozen is not returned. Nothing has been reported as recovered.

No authority or security firm has attributed the attack. There is no public evidence linking it to the Binance theft last Thursday, CoinDesk noted, or to the hot-wallet sweeps at BTCPay Server.

The timing is awkward. Mercado Bitcoin applied to the central bank for authorisation as a crypto broker ahead of Brazil’s 30 Oct licensing deadline, Valor Econômico reported last week.

Protect yourself

  • Use only Mercado Bitcoin’s official channels for updates; expect fake “refund” and “unlock” messages while accounts are frozen.
  • Do not send funds to old Mercado Bitcoin deposit addresses until the exchange says deposits have reopened.
  • Never share login codes with anyone claiming to be support.

If the exchange pays, the customers are whole. Who audits the hot wallets of the next one?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.