Mercado Bitcoin Hack Drains More Than $46 Million

Mercado Bitcoin, one of Brazil’s largest cryptocurrency exchanges, confirmed a security incident in which more than $46 million in digital assets was drained from its wallets Monday. Addresses linked to the incident continued to send and receive funds for hours after the exchange suspended deposits and withdrawals.

Security firms found no evidence of a smart contract exploit. CertiK senior security engineer Dickson Wu’s initial postmortem described an attack that moved through eight smaller blockchain networks, including Base, Optimism and Arbitrum, over about four hours before reaching Mercado Bitcoin’s main hot wallets.

The attackers then sent small amounts of Ether from 27,160 addresses. Wu wrote that the activity could mean the attackers were also able to move funds from customer deposit addresses.

After Mercado Bitcoin announced the temporary suspension, addresses connected to the breach continued sending funds. Thousands of small Ether transfers were also sent to one address.

The exchange said customers had not lost funds and that no data had been leaked. It did not publicly identify the group behind the incident. An investigation is ongoing, and confirmation of a data breach could trigger notification requirements for Brazil’s data protection authority.

By 16:42 UTC, stablecoin issuers Tether and Circle had frozen about $6.2 million of the stolen assets. About $20 million had moved to newly created wallets, while more than $20 million remained in addresses identified as linked to the incident. Those holdings included all 106 bitcoin.

Mercado Bitcoin had 4.5 million users as of July. That month, Tether announced a $20 million investment in the exchange to support its work in tokenization, payments and credit.

The incident came days after Binance reported that about $6.3 billion in cryptocurrency had been stolen from its hot wallets. Binance suspended deposits and withdrawals, pledged to cover customer losses and resumed withdrawals Sunday after replenishing 95% of the stolen assets.