Mercado Bitcoin, a major Brazilian cryptocurrency exchange, confirmed a security breach on Monday that resulted in the theft of over $46 million in digital assets. The incident involved standard transfer mechanisms rather than smart contract exploits, with attackers targeting eight specific blockchain networks including Base, Optimism, and Arbitrum before moving to main hot wallets. Certik senior security engineer Dickson Wu noted that the perpetrators transferred small amounts of Ether from 27,160 distinct addresses, indicating they had access to customer deposit addresses.
Despite Mercado Bitcoin’s announcement that deposits and withdrawals were suspended, funds continued to move out of compromised addresses for hours after the suspension. Approximately $6.2 million of the stolen assets were frozen by stablecoin issuers Tether and Circle by 4:42 pm UTC. About $20 million was transferred into newly created wallets, while more than $20 million remained in addresses identified by the exchange, including all 106 Bitcoin held there. A company spokesperson stated that customers suffered no losses and no data was leaked, though the firm did not address questions regarding the ongoing transfers.
The hack remains under investigation with no attribution to an organized group yet. This event follows a recent $6.3 billion hack at Binance, which also targeted hot wallets but pledged to cover customer losses. Mercado Bitcoin serves 4.5 million users and recently received a $20 million investment from Tether to support expansion in tokenization and payments.
The persistence of fund movements after a declared suspension highlights critical gaps in operational response protocols for centralized exchanges. While Mercado Bitcoin asserted customer protection, the technical reality described by Certik suggests that control over deposit addresses may have been compromised, allowing attackers to bypass standard withdrawal halts. This discrepancy between public statements and on-chain activity raises significant concerns about the effectiveness of emergency containment measures during active breaches.
From a regulatory perspective, the incident underscores the vulnerability of Latin American crypto infrastructure to sophisticated, multi-chain attacks. With Brazil’s data protection authority potentially requiring notification if a data breach is confirmed, the exchange faces dual pressures of financial restitution and compliance scrutiny. The simultaneous occurrence of this hack and the larger Binance incident indicates a broader systemic risk in hot wallet management across the industry, prompting urgent reassessments of custody solutions and real-time monitoring capabilities.
