In this article4 sections
Mercado Bitcoin, the largest crypto exchange in Brazil, told users they will not absorb the cost of a security breach that hit its systems on November 2, according to Decrypt. The exchange said customer balances remain recorded in their accounts and that no data was leaked, while deposits and withdrawals stayed frozen with no announced restart date.
The size of the loss depends on who is counting. Mercado Bitcoin’s own figure was about $38 million, Finbold reported that security firm Hypernative first flagged more than $40 million in suspicious transfers, and Decrypt cited Arkham at at least $46 million and Chainalysis at about $49 million.
Also read: Bitget Raises Hack Estimate to $387.5M as Withdrawals Return
Key facts
- Mercado Bitcoin detected the breach early on November 2 and suspended deposits and withdrawals as a preventive measure.
- The exchange said about $38 million in assets was involved and that $11 million had already been blocked after help from Tether, Circle, Paxos, BRL1 and Chainalysis.
- Hypernative traced suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, per Decrypt; Finbold reported the firm identified transfers to newly created addresses.
- Tether froze more than $4.5 million in USDT tied to the incident, CEO Paolo Ardoino said, according to Decrypt.
- Chainalysis put the total at roughly $49 million with nearly $10 million frozen, while Arkham traced at least $46 million.
How the exchange is responding
In a statement posted on X, Mercado Bitcoin said customer assets were guaranteed and balances continued to be recorded in their respective accounts. It said it activated security and governance protocols immediately and notified the authorities.
The company has not disclosed how the attackers gained access. Finbold reported that the transfers flagged by Hypernative appeared to be ordinary signed transactions rather than an exploit of a smart contract flaw, leaving open whether private keys, signing infrastructure, employee credentials or another part of the exchange’s systems were compromised.
Tether’s freeze stops the stablecoin from moving but does not return it to its owner, which is why the exchange’s commitment to cover the loss carries weight for customers. The same caveat applies to every frozen balance: outside observers cannot verify how much an exchange can actually absorb, and exchanges are not required to show customers their books.
Why it matters
Mercado Bitcoin’s pledge follows a similar promise from Binance after an October 29 breach. Decrypt reported that the FBI blamed that theft, put at more than $6 billion, on North Korea’s TraderTraitor group, while Finbold described it as a record $6.3 billion hack. Neither outlet reported a connection between the two incidents, and Mercado Bitcoin has not linked them.
Binance CEO Richard Teng said on X that the company would absorb the impact rather than pass it to users, adding that about 95% of the affected assets had been replenished, per Decrypt. The two events together renew scrutiny of how centralized exchanges safeguard customer deposits during a hack.
What to watch
Mercado Bitcoin said it will post updates on X and resume service once full security is restored; until then, no restart date has been given. The gap between the exchange’s $38 million figure and analysts’ estimates of $46 million to $49 million will also need reconciling, and the company has yet to explain how the breach happened.
Reported by Decrypt.
Sources: Decrypt, Finbold