Key Highlights:
- Brazilian cryptocurrency exchange Mercado Bitcoin has halted deposits and withdrawals following a multichain exploit resulting in losses estimated to exceed $40 million.
- Security researchers revealed that unauthorized outflows drained assets across at least 10 different blockchains, including Ethereum, Solana, Bitcoin, and Tron.
- Mercado Bitcoin confirmed it had
identified and swiftly contained
the incident, stating that customer funds remain safe and no user data was breached.
Mercado Bitcoin Halts Operations Following Multi-Chain Exploit
Major Brazilian digital asset exchange Mercado Bitcoin suspended all customer deposits and withdrawals on Monday following a substantial security incident that drained company-linked wallets across at least 10 distinct blockchain networks. Initial assessments by cybersecurity and blockchain tracking firms indicate that the total losses from the platform have surpassed $40 million.
The swift exploit targeted Mercado Bitcoin shortly after another massive industry breach, in which the Federal Bureau of Investigation (FBI) attributed the theft of over $6 billion from global exchange Binance to North Korea’s state-sponsored TraderTraitor cyber syndicate, representing the largest cryptocurrency theft recorded to date.
Analysis of the Outflows and Stolen Assets
According to findings shared by Pablo Sabbatella, the founder of cybersecurity consultancy Opsek, the bulk of the malicious transactions occurred in a concentrated window between 06:19 and 06:53 UTC. During this brief timeframe, automated or pre-scripted transfers originated from Mercado Bitcoin-linked wallets spanning Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain (BSC), Stellar, and several other distributed ledgers, routing liquidity directly to newly created attacker addresses.
On-chain forensic data indicates that the attacker currently holds a diverse cache of stolen assets. The accumulated balance includes approximately 2,852 Ethereum (ETH), 106 Bitcoin (BTC), 10,700 Solana (SOL), 6.7 million Stellar Lumens (XLM), and 77,000 Avalanche (AVAX), alongside more than 200 other secondary tokens. Blockchain researchers highlighted that the drainage did not stem from a vulnerable smart contract execution; instead, the illicit movements were executed as standard, plain transactions. How the unauthorized party managed to secure signing access and private key authorization to facilitate the multi-chain transfers remains under active investigation.
Mercado Bitcoin Responds to the Breach
In an official statement published on X (formerly Twitter), Mercado Bitcoin sought to reassure its broader user base, reporting that internal systems had identified and swiftly contained
the breach. The Latin American exchange confirmed that the operational disruption did not compromise personal user information, nor did it directly affect user balances.
Mercado Bitcoin noted that the platform-wide halt on deposit and withdrawal activity is a standard preventive measure designed to maintain balance integrity while operational and technical units investigate the vector of compromise. The exchange’s cybersecurity teams are actively tracing the stolen funds on-chain while working alongside law enforcement and relevant regulatory bodies to identify the perpetrators and mitigate potential liquidation routes.
Why This Matters
The Mercado Bitcoin exploit highlights ongoing security vulnerabilities that centralized exchanges face, particularly regarding private key protection and multi-signature authorization architecture. While decentralized finance (DeFi) platforms are frequently targeted via smart contract flaws, the direct use of standard transactions across multiple networks indicates that compromise at the infrastructure or key management layer remains a severe threat to centralized custodians. Occurring closely behind record-setting nation-state hacks across the global ecosystem, this incident underscores the imperative for centralized exchanges worldwide to reinforce their cold storage operations, internal controls, and transaction-signing thresholds against increasingly sophisticated adversaries.
Frequently Asked Questions
Were customer funds or sensitive data compromised in the Mercado Bitcoin attack?
According to an official statement by Mercado Bitcoin, the exchange swiftly contained the incident, resulting in no customer data breach and no loss of customer funds.
How much was stolen, and what assets were targeted?
Security firms estimate the total loss exceeds $40 million. The attacker acquired an extensive portfolio including roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, and 77,000 AVAX, along with more than 200 other cryptocurrency tokens across at least 10 blockchains.
What caused the breach at Mercado Bitcoin?
On-chain investigations reveal that the theft was executed via plain transactions rather than a smart contract vulnerability. It remains unknown how the unauthorized third party acquired the signing credentials and private key access necessary to approve the transactions.
