Brazil’s largest cryptocurrency exchange, Mercado Bitcoin, suspended deposit and withdrawal services on November 02 after discovering that its hot wallets were drained across at least 10 blockchains.
The incident occurred just days after the net outflow incident at Binance and security alarms like the BTCPay Server hot wallet security incident. This highlights that attacks targeting the custody and signing infrastructure of crypto institutions remain complex and active.
Estimated damages and efforts to freeze fund flows
According to preliminary analysis from on-chain security firm Hypernative, the attacker executed a series of suspicious transfers totaling more than $40 million across 10 different networks, including Bitcoin, Ethereum, Solana, Tron, Avalanche, and Stellar. Wallet tracking data indicates that the bulk of the funds was transferred out between 06:19 and 06:53 UTC on November 02.
From the exchange’s side, Mercado Bitcoin stated that approximately $38 million in assets was directly linked to the breach. Through emergency coordination with issuers and security firms including Tether, Circle, Paxos, and Chainalysis, the platform successfully froze approximately $11 million. Among that sum, Tether confirmed it had frozen over 4.5 million USDT in the attacker’s wallet addresses.
Currently, the method used by the attacker to infiltrate the wallet signing key management system has not been disclosed. Security analysts noted that the transactions were executed as standard token transfers rather than through smart contract vulnerabilities, suggesting that the exchange’s private keys or transaction-signing privileges were compromised.
Impact on users and conditions for resuming services
In an official statement on social platform X on the evening of November 02, Mercado Bitcoin confirmed that the attack had been contained, no user data was compromised, and customers would not suffer any financial loss. However, all deposit and withdrawal gateways remain suspended to support the investigation.
An exchange representative stressed that services will only be reactivated once all security standards are fully satisfied, and there is currently no specific timeline for the resumption of operations.
Although freezing $11 million helped mitigate the actual scale of the loss, the simultaneous compromise of signing keys across multiple blockchains raises significant questions regarding risk management practices among centralized exchanges in Latin America.