Mercado Bitcoin, Brazil’s largest crypto exchange, suspended deposits and withdrawals on Monday after a security incident drained an estimated $40 million from its hot wallets across at least ten blockchains. The exchange said customers suffered no losses and no data leaked, while Tether moved to freeze more than 4.5 million USDT tied to the incident.
The exchange confirmed the incident in a statement on X at 12:56 UTC: “We identified and swiftly contained a security incident in one of our systems early this morning.” It added, “There was no harm to customers; there was no data breach,” and described the suspension of deposits and withdrawals as a precaution while its teams investigate, trace the assets and coordinate with authorities. Bloomberg reported the company said it would absorb the full loss.
What the Blockchain Shows
Blockchain security firm Hypernative put the preliminary loss above $40 million, while Arkham Intelligence pegged it at roughly $46 million. The attacker holds about 106 BTC, 2,852 ETH, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens, spread across fresh addresses on Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar, according to an alert shared by Opsek founder Pablo Sabbatella.
Hypernative described the outflows as “plain transfers, not a smart contract exploit,” and said it was still unclear how the attacker obtained signing access. That detail matters: the movements were signed as if authorized by the source wallets themselves, pointing to a compromise of keys or signing infrastructure rather than a code vulnerability. The exchange later published the destination addresses so security firms and other parties could monitor and track the funds.
Tether Moves to Freeze
Stablecoin issuer Tether froze more than 4.5 million USDT connected to the incident, CEO Paolo Ardoino confirmed on X. The freeze echoes the pattern that followed the Binance breach days earlier, when Tether and Circle blacklisted hundreds of millions in stablecoins to cap the attackers’ haul. Tether has a direct stake in the exchange: it invested $20 million in Mercado Bitcoin in July, when the exchange said it served 4.5 million users.
Arkham analyst Emmett Gallic said the attacker was still active as the day wore on: “Lots of old deposit addresses are being swept by the hacker currently, while they sell off meme coins and altcoins.” That selling is the mechanism by which an exchange theft leaks into market prices, as the attacker converts illiquid tokens into more liquid assets.
A Brutal Stretch for Exchanges
The Mercado Bitcoin incident lands days after the largest exchange hack on record: the $6.3 billion Binance breach that the FBI attributed to North Korea’s TraderTraitor group. Those two events sit atop a year that already included the roughly $388 million Bitget hack in September and the $1.5 billion Bybit exploit in February 2025.
The common thread across several of these breaches is a compromise of signing infrastructure or third-party tooling rather than a smart-contract flaw — a pattern security firm Hacken quantified earlier this quarter, attributing 77% of the $1.18 billion in third-quarter hacking losses to supply-chain blind spots.
What Comes Next
Mercado Bitcoin has not said when deposits and withdrawals will reopen, only that it is working to restore operations safely. The immediate markers are the recovery of the frozen assets, the outcome of the investigation into how signing access was obtained, and whether the exchange’s decision to absorb the loss — rather than pass it to customers — holds up as the full scope of the drain becomes clear.
This article is not intended as financial advice. Educational purposes only.
