Mercado Bitcoin hack drains tens of millions, exchange vows to make users whole
Security & Exploits ·
Brazil's largest crypto exchange says customer balances are safe after a breach pulled funds across multiple blockchains, but it has given no timeline for restoring deposits and withdrawals.
Mercado Bitcoin confirmed it detected intrusion into one of its systems early on November 2 and immediately halted deposits and withdrawals as a precaution. Estimates of the amount lost vary by source: the exchange itself cites roughly $38 million, security firm Hypernative puts the figure above $40 million, Arkham's tracing shows at least $46 million, and Chainalysis estimates about $49 million, according to Decrypt. The company says the stolen assets moved across at least 10 different chains, including Bitcoin, Ethereum, Solana and Tron.
The exchange says it has already worked with partners including Tether, Circle, Paxos, BRL1 and Chainalysis to freeze about $11 million of the funds, while Chainalysis separately reports close to $10 million frozen. Tether's chief executive said more than $4.5 million in USDT linked to the incident had been locked. Freezing tokens stops them from moving further but does not return them to the exchange, which is why Mercado Bitcoin's commitment to absorb the loss itself — rather than pass it to customers — is the central assurance at stake, per Decrypt.
Mercado Bitcoin says no customer funds were lost and no personal data was exposed, though it has not disclosed how the intruders gained access or whether its own $38 million estimate already accounts for the frozen amount. The incident lands days after a separate $6 billion theft at Binance, which the FBI attributed to a North Korea-linked group; Mercado Bitcoin has not drawn any connection between the two events.
The pattern echoes Binance's own pledge following its breach, where the exchange said it would cover the shortfall from its own funds rather than its users'. In both cases, outside observers have no way to verify that either exchange holds sufficient reserves to honor that promise, since neither has opened its books publicly.
What remains open is when trading will resume: Mercado Bitcoin says deposits and withdrawals stay frozen until it confirms its systems are fully secured, with updates to come, but no restart date has been set. Also unresolved is the exact loss figure, given the spread between the exchange's own $38 million tally and the higher third-party estimates, as well as how the attackers initially breached the platform.