Brazilian exchange Mercado Bitcoin confirmed a security incident on Monday after blockchain analysts estimated that more than $46 million was drained from wallets tied to the firm. The company said it suspended deposits and withdrawals, but investigators reported that related activity continued for hours afterward—raising questions about how quickly affected systems were fully isolated.

CertiK senior security engineer Dickson Wu published an incident overview, describing attackers who “picked at eight small chains for four hours,” then shifted focus to the exchange’s primary hot wallets. According to Wu, the operation ultimately involved the movement of Ether (ETH) from 27,160 different addresses, while small transfers into fewer destinations appeared to help consolidate control.

Key takeaways

Blockchain analysis estimated the breach involved more than $46 million, with activity spanning multiple networks before reaching Mercado Bitcoin’s main hot wallets.
Even after Mercado Bitcoin announced a suspension of deposits and withdrawals, analysts reported funds continued to move from breach-linked addresses for hours.
CertiK’s Dickson Wu said the attackers used a pattern consistent with standard transfers rather than a single smart-contract exploit.
By 4:42 pm UTC, stablecoin issuers Tether and Circle had frozen about $6.2 million of the stolen funds.
Mercado Bitcoin said the incident would have no financial impact on customers, though it did not address why funds continued transferring after the suspension notice.

Attackers shifted across networks before reaching hot wallets

In a post-mortem shared by CertiK’s Dickson Wu, the incident is described as a phased operation. Wu wrote that the attackers “picked at eight small chains for four hours,” naming Base, Optimism, and Arbitrum among the networks involved. The implication is that adversaries tested liquidity and pathways across environments before escalating to assets more central to the exchange’s operations.

After this initial period, Wu said the activity moved to Mercado Bitcoin’s main hot wallets. He further reported that the attackers transferred tiny amounts of Ether (ETH) from 27,160 different addresses—an approach often used to reduce traceability and complicate response efforts by spreading withdrawals across many sources.

Wu added an additional warning: “So whoever did this can also move money out of MB’s customer deposit addresses.” That statement matters because deposit infrastructure is where user balances can be reflected; if attackers gained access to related controls, the risk profile could extend beyond already-withdrawn funds.

Suspension didn’t stop related transfers immediately

Wu’s update also highlighted a timing mismatch. Mercado Bitcoin stated it had suspended deposits and withdrawals, but Wu reported that funds continued moving out of addresses associated with the breach. He said that after the suspension announcement, the flow was followed by thousands of small ETH transfers into a single address, consistent with consolidation behavior after initial access.

In an interview with Cointelegraph, a Mercado Bitcoin spokesperson said customers suffered no losses and that no data had been leaked. However, the exchange did not respond to further questions about continued transfers. The situation also carries a compliance angle: a data breach, depending on what was accessed, can trigger notification obligations to Brazil’s data protection authority.

At the time of the report, the hack had not been attributed to a specific organized group and remained under investigation.

Where the stolen funds appeared to go

According to Wu’s analysis of the stolen portion, stablecoin issuers Tether and Circle had frozen approximately $6.2 million by 4:42 pm UTC. Analysts also reported that about $20 million had been transferred into newly created wallets, while more than $20 million remained in addresses associated with the incident identified by Mercado Bitcoin, including all 106 BTC.

This mix—frozen assets on one side, transfers to new wallets on the other, and a large remaining balance in identified addresses—reflects why exchange security incidents often evolve over time. Freezes may reduce the damage, but they do not necessarily reverse already-executed movements or fully resolve whether other address categories (including deposits) were exposed.

Broader regional context and industry contrast

Mercado Bitcoin is a major player in Brazil, with 4.5 million users reported as of July. The exchange operates in a broader ecosystem that includes stablecoin issuers supporting growth initiatives. In the same period, Tether announced a $20 million investment tied to expansion in areas including tokenization, payments, and credit.

Mercado Bitcoin’s incident also comes amid a wave of high-profile exchange breaches in recent weeks. Cointelegraph previously reported on Binance’s record $6.3 billion hack of its hot wallets, in which the exchange suspended deposits and withdrawals and later pledged to cover customer losses. Binance began resuming withdrawals on Sunday after stating it had replenished 95% of the stolen assets.

Earlier in Latin America, another Tether-backed exchange—Chile’s Orionx—announced its closure in September following a forensic audit that found more than $7 million in customer assets had moved to wallets outside its control. That comparison is relevant not because the cases are proven identical, but because it underscores the central question regulators and users increasingly ask after each incident: how far did access extend, and did the exchange regain sufficient control before additional damage spread?

For Mercado Bitcoin users and market observers, the next critical details are likely to be how quickly the company identified all affected address sets, whether deposit-related infrastructure was truly protected, and how investigators account for the remaining funds still sitting in breach-linked addresses. The pace of further freezes—and any final attribution of the attackers’ method—will determine how comprehensively this incident ends.