Key Highlights:
- Blockchain security firm Hypernative revealed that over $40 million drained from Mercado Bitcoin across at least 10 blockchains in seemingly authorized transfers.
- On-chain investigator ZachXBT uncovered an ongoing, separate theft targeting an unnamed European Union entity, pushing total estimated losses past $133 million.
- The European exploitation involved complex cross-chain laundering and Monero conversions, with ZachXBT warning that a lack of public disclosure prevented law enforcement from freezing tens of millions of dollars.
Mercado Bitcoin Hit by Multichain Security Breach Exceeding $40 Million
The cryptocurrency sector is facing another wave of severe exploits following revelations of substantial unauthorized outflows from Mercado Bitcoin. According to findings published by blockchain cybersecurity firm Hypernative, more than $40 million was systematically transferred out of wallets affiliated with the major Latin American exchange overnight. The illicit movements spanned at least 10 distinct blockchain networks, including Bitcoin, Ethereum, Solana, and Tron. Mercado Bitcoin had previously stated that no customer data had leaked during the event.
Hypernative’s preliminary timeline shows that the initial suspicious transfer was identified at 2:15 UTC. The operational breach escalated sharply several hours later, with the most concentrated outflows occurring between 6:19 and 6:53 UTC. During this window, wallets tied to Mercado Bitcoin initiated massive transfers directly to newly generated recipient addresses. Notably, the on-chain activity mirrored standard, legitimately signed transfers, indicating that the source wallets themselves authorized the outflows. Hypernative confirmed that investigators have yet to determine precisely how the unauthorized actor secured the administrative or cryptographic capability to sign the transactions.
ZachXBT Identifies $133 Million Drain Linked to European Entity
As security teams assess the Mercado Bitcoin breach, parallel investigations have revealed an even larger exploit impacting European financial infrastructure. Prominent on-chain investigator ZachXBT flagged a suspected multi-million-dollar theft linked to an unnamed European Union entity, initially identified at $106 million. Subsequent tracking uncovered an additional $27 million in unauthorized withdrawals from centralized exchanges, raising the total confirmed sum taken by the illicit actor to more than $133 million.
The capital flight originated with large withdrawals denominated in stablecoins, specifically USDC and USDT. The perpetrator swiftly launched an intricate asset laundering strategy, systematically swapping USDC for Ethereum (ETH) and passing transfers through non-custodial and instant exchange platforms, including Kyrrex and WellWallet. To break on-chain visibility, the exploiter bridged assets across separate blockchain networks and routed funds through Wagyu to convert the capital into the privacy-centric cryptocurrency Monero (XMR).
Allegations of an Institutional Cover-Up and Delayed Disclosure
Addressing the profile of the perpetrator, ZachXBT expressed high confidence that the laundering operation is not tied to North Korea’s state-sponsored Lazarus Group, referencing specific operational and laundering indicators observed across the ledger. Instead, the investigator believes the incident stems from an unannounced breach inside a prominent financial institution based in Western Europe, raising concerns that the affected entity may be attempting an internal cover-up.
The investigator also voiced sharp criticism over the missing incident disclosure, noting that the absence of rapid public reporting actively impaired recovery efforts. ZachXBT asserted that over $30 million of the stolen assets have already been processed through irreversible laundering paths—funds that potentially could have been seized or frozen by European Union law enforcement agencies had transparency protocols been initiated promptly after the breach occurred.
Why This Matters
These dual incidents highlight the critical vulnerabilities that continue to plague centralized platforms and custodial organizations across global jurisdictions. Coming on the heels of the massive reported $6.3 billion Binance hack, the simultaneous breach at Mercado Bitcoin and the multi-chain draining of an EU institution show persistent attack surfaces surrounding cryptographic key management and authorized transaction controls. Furthermore, the handling of the EU breach underscores an ongoing debate regarding corporate disclosure duties, as delays in acknowledging high-value security incidents directly impede cross-chain tracing and restrict law enforcement’s capacity to freeze illicit assets before they enter obfuscated privacy networks.
Frequently Asked Questions
How were funds moved out of Mercado Bitcoin?
According to blockchain intelligence firm Hypernative, the transactions appeared as ordinary signed transfers directly from the exchange’s wallets to newly generated addresses across at least 10 blockchains. It remains unconfirmed how the attacker secured the signing authority to execute the withdrawals.
Is North Korea’s Lazarus Group behind the $133 million EU theft?
No. On-chain investigator ZachXBT stated that based on multiple laundering indicators and transaction behaviors, he is highly confident the ongoing laundering operation targeting the unnamed Western European entity is not connected to North Korea’s state-sponsored Lazarus Group.
What methods did the EU entity exploiter use to launder the stolen crypto?
The attacker initially moved USDC and USDT before swapping the stablecoins for ETH, bridging capital across several different blockchains, processing volume through instant exchange services like WellWallet and Kyrrex, and converting funds into the privacy coin Monero (XMR) via Wagyu.
